Penetration Testing Engineer, Amazon

• You must produce results in the face of ambiguity and imperfect knowledge, and foster constructive dialogue and drive resolution when faced with disagreement
• You are considered a technical leader on your team
• You work efficiently and routinely deliver the right things with limited guidance
• Your work focuses on ambiguous problem areas in existing or new hardware and software initiatives
• You take a long term view of your team's processes & software, understanding how it fits into the business
• You proactively fix architectural deficiencies and/or propose larger project scopes, which may require the work of a team
• You split that work into parallel tasks that can be performed by you and others and then reassembled successfully
• A successful candidate will need a combination of troubleshooting, technical, and communication skills, as well as the ability to handle a mix of complex decisions
• Experience with AWS technologies and services (e.g. S3, Lambda, EC2, KMS, IAM, etc.) and minimum of 3 years of experience in professional penetration testing, source code auditing, bug hunting, or CTF experience
• Domain expertise in at least two areas, including: security architecture and engineering, communication and network security, identity and access management (IAM), security assessment and testing, cryptography, and software development security
• Experience finding security issues in multiple languages (including one or more of: Java, Ruby, Python, JavaScript, Rust, C) and Minimum of 2 years of experience scripting in Python or other equivalent interpreted languages
• Minimum of 2 years of professional experience with security engineering practices such as in web application security, network security, authentication and authorization protocols, cryptography, automation and other software security disciplines

Desirable

• We are looking for a Penetration Testing Engineer who has a strong passion for security-at-scale
• You will be on a team responsible for the delivery of continuous assessments
• You will be asked to solve complex technology problems, build tools to automate your way out of manual efforts, and influence the way Amazon services respond to and mitigate threats
• We are looking for a Security Engineer to help ensure all of our web services and applications are designed and implemented to the highest security standards
• You will be responsible for web application, network, and operations penetration testing
• You will be responsible for automating repetitive tasks
• You will be responsible for influencing Amazon services through the creation of threat mitigation plans
• You will work directly with internal teams to solve challenging software problems
• Perform penetration testing of complex proprietary software and hardware for AWS services
• Manually audit the source code of web services and software authored in-house by Amazon
• Write proof of concept code to demonstrate the severity of a potential security issue
• Provide clear communication on issues to developers that suggest and help to test the fix
• Partner with AWS developers to drive improvement in application security as a result of security
• Provide actionable long term risk mitigation guidance