About This Role
This role involves securing Amazon's public-facing devices and services by working with external security researchers and Amazon teams. The successful candidate will be responsible for ensuring urgent vulnerability remediation and improving Amazon's security through disclosure and mitigation.
Responsibilities
- Triage externally disclosed hardware and service security issues, suggest fixes, and collaborate with builder teams for remediation
- Identify risk trends in Amazon devices and services, and collaborate with builder teams for remediation
- Automate manual processes to streamline security work
- Lead improvements to Amazon programs and processes
- Write and deliver high-quality documents for technical and non-technical audiences
- Manage relationships with customers and security researchers
- Ensure vulnerabilities are remediated with urgency by partnering with service teams
- Ensure what is learned through disclosure and mitigation improves the security of Amazon’s device and software development life cycle
- Triage disclosed risks and collaborate with customers and security researchers to maintain and raise Amazon’s high security bar
Requirements
- Experience in any combination of the following: application security frameworks, security code reviews, incident response, secure infrastructure, penetration testing, mobile security, cloud security, AI security, identity and access controls, threat modeling, cryptography, threat intelligence, or secure software development
- Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent
- Experience in scripting, programming, or security code reviewing in a common language, such as Python, Java, or C++
- Experience with AWS products and services
- Experience working with device technologies under development, familiarity with flashing firmware, basic device debugging and familiarity with reading/pulling device logs, or experience scripting in one or more language (e.g. Bash, Python, Perl, Ruby)
- Deep understanding of hardware security, firmware analysis, operating system internals, and low-level programming
- Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics)
- 5+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience
- Experience supporting Red Team, Penetration Testing, or Bug Bounty programs
About the Company
Amazon is committed to maintaining customer trust and security by continuously improving its device and software development life cycle.
