Senior Security Engineer, AWS Vulnerability Management, AWS Vulnerability Management - Host OS and Third Party Software

Do you want to build security solutions in third party software and software supply chain that have not been built anywhere at this scale?

Do you want to build security solutions in third party software and software supply chain that have not been built anywhere at this scale? Amazon is hiring for our Third Party Software and Software Supply Chain Vulnerability Management team. You will put your offensive security background to work — penetration testing, exploit development, or threat intelligence — to find the attack paths an adversary would take through our vendors and package registries, and to decide which risks we close first.

This is a role where the hardest problems are not yet defined, and defining them is the job. You will own outcomes, not tickets. You will set the security bar for the top CI/CD tool chains at Amazon, drive mitigation of supply chain incidents at machine speed, and build the defense against a Solar Winds-class vendor compromise before it happens. You will set the security requirements and hand validated designs to software development engineers to build at scale, so your judgment sets the direction for a team.

You will also help build our offensive security capability from the ground up and mentor the security engineers around you. If you want to own hard, ambiguous security problems with Amazon-wide impact and grow the team that solves them, this role is for you.

• Hunt for the attack paths an adversary would take through Amazon's third party software packages and supply chain components, using penetration testing and threat intelligence to decide which risks we close first.
• Define and enforce the security bar for Amazon's curated package registry and top CI/CD tool chains, close the riskiest bypass paths, and hand validated designs to software development engineers to implement.
• Build and test detection-to-block automation that mitigates supply chain incidents within minutes, and lead rapid response for zero-day vulnerabilities in internet-facing third party appliances.
• Raise the security bar across code repositories through architecture review, code review, and reusable frameworks that engineering teams can pick up with minimal effort.
• Mentor security engineers and shape a culture of fast, pragmatic solutions while communicating risk assessments and design decisions to technical peers and senior leadership.

A suspicious package lands in the curated registry and something about it looks wrong. You pull the threat intelligence, trace what it touches, and make the call thousands of builders are waiting on: block it, or let it through. By the time your coffee is cold, you've either stopped a supply chain compromise or cleared a false alarm.

Later you're working with an AWS engineering team that wants to wire a new toolchain into their pipeline. You've already mapped how an attacker would abuse it, so you set the security bar the integration has to clear. They build to your spec, not the other way around. In the afternoon you throw a simulated supply chain attack at the detection-to-block automation, find the gap it misses, prove it, and hand a validated design to an SDE to close it.

Our team owns Third Party Software and Software Supply Chain Vulnerability Management for Amazon, building mitigations at a scale that has not been done before. We partner with AWS engineering teams across the company, working directly with their architectures to prioritize and reduce security risk. You will have visibility to VPs and Distinguished Engineers in AWS and Amazon Security, and the problems you solve here protect not just AWS but all of Amazon.

We value an inclusive culture where pragmatic security…