Security Incident Response Engineer — Flexible Hours & Impact

Amazon; Herndon (VA); On-site; USD 159,000 - 202,000; Full time

Benefits offered by this job

Health insurance

RSUs

401(k) matching

Paid time off

Parental leave

Job summary

Amazon's Security team is looking for a Security Incident Response Analyst to detect, investigate, and respond to threats against a U.S. Government program building a purpose-built, classified AI Factory.

In Herndon, VA, you will monitor telemetry, triage alerts, and drive incidents through containment, eradication, and recovery. You will work with detection engineers, SOC analysts, forensics, and government counterparts to turn every event into better detections and playbooks, and coordinate

Qualifications

• Experience triaging and developing security alerts and response automation, front-line analysis, and escalation support.
• Knowledge of fundamentals of networking, security, databases (relational or NoSQL), operating systems (Unix, Linux, and/or Windows).
• 3+ years of incident response, SOC, or security operations experience.
• Current, active US Government Security Clearance of TS/SCI with Polygraph.

Responsibilities

• Monitor security telemetry and triage, investigate, and elevate alerts on the disconnected platform.
• Drive incidents through the full response lifecycle: containment, eradication, recovery, and after-action.
• Develop and tune detection content and response playbooks from incident learnings.
• Coordinate incident reporting and handoffs with the ISSM and Government counterparts.

Skills

TS/SCI with Polygraph

Incident response

Networking fundamentals

Security fundamentals

Databases (relational/NoSQL)

Operating systems (Unix/Linux/Windows)

Security certifications (GIAC/CISSP/C&

Tools

Unix/Linux

Windows

Job description

Amazon's Security team is looking for a Security Incident Response Analyst to detect, investigate, and respond to threats against a U.S. Government program building a purpose-built, classified AI Factory.

In Herndon, VA, you will monitor telemetry, triage alerts, and drive incidents through containment, eradication, and recovery. You will work with detection engineers, SOC analysts, forensics, and government counterparts to turn every event into better detections and playbooks, and coordinate