Senior Security Engineer, Supply-Chain & Third-Party Risk

Amazon Inc.; Austin (TX); On-site; USD 178,000 - 227,000; Full time

Job summary

Amazon Inc. is hiring for a role in Third Party Software and Software Supply Chain Vulnerability Management.

You will apply offensive security skills to identify risks in vendors and package registries, set security bars for top CI/CD toolchains, and drive rapid mitigation of supply chain incidents at machine speed. You will help build the offensive security capability from the ground up and mentor security engineers, owning hard, ambiguous problems with Amazon-wide impact.

Qualifications

• 5+ years identifying security issues and risks and developing mitigation plans.
• 4+ years troubleshooting systems issues, analyzing logs, or automating tasks.
• 4+ years scripting, programming, and security code review in common languages.
• Experience in industry-based security vulnerabilities identification, attack patterns, and remediation techniques.

Responsibilities

• Hunt for attack paths through third party software and supply chain components using penetration testing and threat intelligence.
• Define and enforce the security bar for the package registry and CI/CD toolchains.
• Build and test detection-to-block automation to mitigate supply chain incidents within minutes.
• Raise security standards across code repositories through architecture and code reviews.
• Mentor security engineers and communicate risk assessments to peers and leadership.

Skills

Security issue identification

Threat intelligence

Log analysis

Scripting

Programming languages: Scala

Programming languages: Java

Programming languages: Python

Programming languages: C/C++

Programming languages: Go

Mentorship / tech lead

Job description

Amazon Inc. is hiring for a role in Third Party Software and Software Supply Chain Vulnerability Management.

You will apply offensive security skills to identify risks in vendors and package registries, set security bars for top CI/CD toolchains, and drive rapid mitigation of supply chain incidents at machine speed. You will help build the offensive security capability from the ground up and mentor security engineers, owning hard, ambiguous problems with Amazon-wide impact.