Security Engineer, Amazon

• BS in Computer Science or related field, or equivalent work experience
• Minimum of 3 years of experience with at least two of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, penetration testing, cloud security, mobile security, and network security
• Intermediate knowledge and understanding of security engineering, system and network security, authentication and security protocols, cryptography, or application security
• Experience reading and writing in at least one programming language

Desirable

• As an AppSec engineer, you will collaborate with software development teams to ensure we keep our customers safe while developing these novel services
• In a given day, you might be inspecting an application’s code for security issues, building a new framework to help our software developers build faster and more securely, or fine-tuning the design for a new service alongside its software developers
• Creating, updating, and maintaining threat models for a wide variety of software projects
• Manual and Automated Secure Code Review, primarily in Java, Python and Javascript
• Development of security automation tools
• Adversarial security analysis using cutting-edge tools to augment manual effort
• Security training and outreach for internal development teams
• Security architecture and design guidance
• Independently solve security problems that require novel methods or approaches
• Influence your team’s and partners’ process, priorities, and choices to improve outcomes
• In a day in this role, you could be collaboratively coding authorization tests with a developer, strategizing how to move a deeply heterogenous application family to a greater security posture, or diving deep into our data to understand what key controls are hardest for our developers to achieve
• On the other hand, you could be creating a wrapper library to help our developers call APIs securely, or just working with a junior engineer to help them assess if evidence a dev provided actually fulfills one of our key controls