Security Industry Specialist, Amazon

• The successful candidate will be a technically experienced and innovative security and compliance professional who has the ability to understand security processes, effectively communicate with technical teams and business leaders alike, and be able to drive automated and scalable process improvements across internal organizations and teams
• Bachelor’s Degree in Computer Science, Information Systems Management, Mathematics, Accounting/Auditing, or other related fields
• 5+ years experience in security, audits, customer trust, control assessments, or risk assessments
• 5+ years experience assessing complex technical processes

Desirable

• Amazon's Security Risk and Compliance (SRC) team is currently hiring a Security Compliance Specialist to focus on preparing for and supporting third-party attestation audits
• This includes preparing SOC2 reports and regulatory/industry certifications along with developing standard security response protocols for third-party inquiries submitted to Amazon, Amazon’s corporate customers, business associates, and other third party (3P) partners
• The Security Compliance Specialist will handle multiple requests submitted for proof of compliance with industry and regulatory security requirements and due diligence questionnaires daily
• The SRC team obsesses over our customers and work to ensure that they are confident that Amazon cares about data confidentiality, integrity, and availability by providing third-party attestations as proof of compliance
• To support successful attestations, the SRC team identifies applicable controls, assesses their effectiveness, and works with control owners to remediate the findings
• Understand and serve as a subject-matter expert around Amazon security controls
• Dive deep into the Amazon control environment to develop broad domain and technical understanding of control activities and implementation to articulate compliance to key stakeholders
• Developing a knowledge base of Amazon control activities and implementations; vetting with business partners and security stakeholders
• Communicate to leadership key risks and areas of program improvement, as well as seek diverse opinions and coordinate improvement efforts
• Develop broad domain and technical understanding of Industry requirements and regulatory expectations to drive process improvement initiatives
• Preparing for SOC2, SIG, ISO 27001, US Government regulations/standards, and other certifications and assessments by identifying applicable controls, assessing control readiness for third-party assessments, recommending appropriate remediation strategies, and tracking remediation activities to completion
• Leading and managing projects and campaigns with excellent project management skills
• Clearly communicating vision, deliverables, and project status to management and key technical and business stakeholders
• Delivering recommendations and risk interpretations in a clear, concise and audience-specific format