Security Engineer, Amazon

• Bachelor’s degree in Computer Science, Information Security, Engineering or related field with 3+ years of experience in red teaming and/or penetration testing
• Experience with offensive security testing tools (Cobalt Strike, Sliver, etc.) and MITRE ATT&CK framework
• Understanding of security vulnerabilities and mitigations with experience emulating both external and insider threats
• Scripting experience (in Python, JavaScript, etc.)

Desirable

• Amazon’s Customer Logistics Security team is looking for a skilled security engineer to join our team’s efforts to help keep Amazon secure by uncovering and exploiting vulnerabilities
• In this role, you will be part of a dedicated team of talented security engineers performing penetration testing and red teaming exercises
• You will strive to understand systems, software, and services deeply and develop creative ways to break assumptions in order to find vulnerabilities
• You will help mitigate vulnerabilities/risks by providing actionable guidance to product teams and drive long term security improvements
• You will build automation and tooling to solve security problems at scale for our customers
• Conducting high quality penetration tests and red team engagements independently, or as part of a team
• Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations
• Contributing to team tooling, innovation, and improvements
• Communicating and collaborating with partner teams, service owners, other security teams, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings
• A day in the life
• As a security engineer, you will perform various day-to-day activities related to ensuring the security of Amazon's systems
• These tasks may include conducting offensive security engagements to identify vulnerabilities in systems that could be exploited by attackers, providing training and outreach to internal development teams to improve their understanding of security best practices, developing security guidance documentation to help others understand how to implement secure systems and applications, delivering security metrics to stakeholders and working on improving the overall security posture of our customers