Senior Security Engineer, AWS Vulnerability Management, AWS Vulnerability Management - Host OS and Third Party Software

Amazon.com Services LLC is hiring a Senior Security Engineer to strengthen AWS Vulnerability Management with a focus on Third Party Software and Software Supply Chain Vulnerability Management . This onsite role in Austin, TX puts you close to the systems and teams that need fast, reliable security improvements across package registries and CI/CD toolchains.

You will help deliver security outcomes through pragmatic engineering: researching attack paths, setting clear security requirements for curated software, and building detection-to-block automation intended to mitigate supply chain incidents quickly. Collaboration is a core part of the work, including incident mitigation leadership and guidance through architecture and code reviews.

Responsibilities

• Hunt for attack paths an adversary could take through Amazon third party software packages and supply chain components, using penetration testing and threat intelligence to prioritize which risks to close first.
• Define and enforce the security bar for Amazon’s curated package registry and key CI/CD toolchains , close high‑risk bypass paths, and provide validated designs to software development engineers for implementation.
• Build and test detection-to-block automation to mitigate supply chain incidents within minutes, and lead rapid response for zero-day vulnerabilities in internet‑facing third party appliances.
• Raise the security baseline across code repositories through architecture review , code review , and reusable frameworks engineering teams can adopt with minimal effort.
• Mentor security engineers and help shape a culture focused on fast, pragmatic solutions, while communicating risk assessments and design decisions to technical peers and senior leadership.

Requirements

• 5+ years of experience identifying security issues and risks, and developing mitigation plans.
• 4+ years of non‑internship experience troubleshooting systems issues, analyzing logs, or automating complex tasks using command‑line tools.
• 4+ years of non‑internship scripting, programming, and security code review in common programming languages.
• Non‑internship experience identifying industry security vulnerabilities, attack patterns, and remediation techniques.
• Knowledge of at least two programming languages: Scala , Java , Python , C/C++ , or Go .
• Experience mentoring, serving as a tech lead, or leading an engineering team.

Technologies

• Scala, Java, Python, C/C++, Go

Preferred Qualifications

• 3+ years of any combination of: application security frameworks, identity and access controls, incident response, mobile security, cloud computing and security, AI security, threat intelligence, and penetration testing.
• Experience applying threat modeling or other risk identification techniques (or equivalent).
• Experience with security in service‑oriented architectures/microservices and web services.

Benefits

• Sign‑on payments
• Restricted stock units (RSUs)
• Health insurance including medical, dental, vision, prescription, Basic Life & AD&D, plus option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, and Adoption and Surrogacy Reimbursement coverage
• 401(k) matching
• Paid time off
• Parental leave

Compensation: USD 178,400 - 226,700 per year.

Minimum experience: 5 years.