Senior Security Engineer, Amazon

• The ideal candidate combines technical acumen with an ability to lead by influence and communicate clearly
• Technically, this person will be a security generalist with one or more areas of deep expertise
• In their communication, they will clearly articulate risks to technical and non-technical audiences alike
• Interpersonally, successful candidates will effectively harmonize disparate opinions while effectively prioritizing risks to guide their partners towards secure solutions.
• 4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
• 5+ years of work in identifying security issues and risks, and developing mitigation plans experience
• 4+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
• Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
• Bachelor's degree
• Experience applying threat modeling or other risk identification techniques or equivalent
• Broad and deep knowledge across application security domains
• 8+ years of Application Security or Development experience

Desirable

• In Amazon Stores, we ship some of the widest arrays of technology found at any company
• From Amazon.com to world class machine learning pipelines, from digital healthcare to no-checkout retail, we push the boundaries of technology in every direction using the globe’s largest AWS deployment
• As a Senior Security Engineer, you will collaborate with software development teams to ensure we keep our customers safe while developing these novel services
• In a given day, you might be inspecting an application’s code for security issues, building a new framework to help our software developers build faster and more securely, or fine-tuning the design for a new service alongside its software developers
• * Creating, updating, and maintaining threat models for a wide variety of software projects
• * Manual and Automated Secure Code Review, primarily in Java, Python and JavaScript
• * Development of security automation tools
• * Adversarial security analysis using innovative tools to augment manual effort
• * Security training and outreach for internal development teams
• * Security architecture and design guidance
• * Independently solve security problems that require novel methods or approaches
• * Influence your team’s and partners’ process, priorities, and choices to improve outcomes