Senior Security Engineer, Third-Party Software Supply Chain

Amazon Web Services (AWS); Arlington (VA); On-site; USD 178,000 - 227,000; Full time

Benefits offered by this job

Health insurance

RSU program

Job summary

Amazon.com Services LLC in Arlington, VA is seeking a senior security professional to lead Third Party Software and Software Supply Chain Vulnerability Management. You will apply offensive security methods to identify attack paths in vendor ecosystems and decide which risks to close first.

You will set security requirements for curated registries and CI/CD toolchains, and mentor engineers to build defenses at scale.

Qualifications

• 5+ years of work identifying security issues and developing mitigation plans.
• 4+ years troubleshooting systems issues and automating tasks using command line tools.
• 4+ years scripting and security code review in common languages.
• Experience in industry-based security vulnerabilities, attack patterns, and remediation techniques.
• Knowledge of at least two of: Scala, Java, Python, C/C++, or Go.

Responsibilities

• Hunt for attack paths through third party software and supply chain components using penetration testing and threat intelligence.
• Define and enforce security bar for Amazon's curated package registry and top CI/CD toolchains; hand designs to engineers.
• Build and test detection-to-block automation to mitigate supply chain incidents quickly and lead rapid ZERO-day response.
• Raise the security bar across code repositories via architecture reviews, code reviews, and reusable frameworks.
• Mentor security engineers and communicate risk assessments and design decisions to peers and leadership.

Skills

Security issue identification

Mitigation planning

Troubleshooting logs

Scripting & security code review

Attack patterns knowledge

Mentoring / tech lead

Job description

Amazon.com Services LLC in Arlington, VA is seeking a senior security professional to lead Third Party Software and Software Supply Chain Vulnerability Management. You will apply offensive security methods to identify attack paths in vendor ecosystems and decide which risks to close first.

You will set security requirements for curated registries and CI/CD toolchains, and mentor engineers to build defenses at scale.