Security Engineer

Who you are

• If you want to grow your interest in AI/ML services like Amazon Bedrock, SageMaker, generative AI, large language models, and responsible AI — we're right here on the journey with you
• 2+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
• Experience working in identifying security issues and risks, and developing mitigation plans
• 2+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
• Experience as a mentor, tech lead or leading an engineering team
• Experience applying threat modeling or other risk identification techniques or equivalent
• Experience with security in service-oriented architectures/microservices and web services

What the job involves

• Join the team that helps protect the Amazon and our customers
• The scale of Amazon and diversity of customers means your work would have far-reaching impacts across a broad range of industries around the world
• Our highly collaborative, global team thrives on flexibility and is committed to each team member's growth regardless of where they are
• The Amazon AI Security team is looking for a Security Engineer to design security controls and help validate that our AI/ML services, applications, and emerging technologies are designed and implemented to the highest security standards
• Your responsibilities include analyzing the security of AI/ML applications and services, discovering and addressing security issues, building security automation, and decisively taking action to mitigate emerging threats throughout a full secure development life-cycle (SDLC)
• This role will provide career growth opportunities as you gain new security skills in the course of your work
• Security Engineers on the AI Security team have an opportunity to experiment, learn, build tools, and work with teams building new AI/ML technology and services at a massive scale
• Security Engineers at all levels have the opportunity to learn from and be mentored by those who are building and securing our AI services
• A Security Engineer is also expected to be a mentor for others and be a trusted security advisor within the organization
• A Security Engineer at Amazon is expected to make significant contributions to the AI Security team and to multiple groups throughout Amazon
• Security Engineers are expected to develop custom solutions to complex security risk problems and apply appropriate technologies while following security engineering best practices
• This role requires a Security Engineer who can be trusted within AI Security and by teams throughout Amazon on at least one knowledge domain, while being able to apply security engineering best practices in a broad range of technical areas
• A Security Engineer must demonstrate strong Amazon Leadership Principles
• This role requires the ability to foster constructive dialogue and seek resolution when confronted with differing opinions on security risks
• Engineers in this role are expected to participate fully in the planning of the AI Security team and constantly seek opportunities for process improvement
• A successful candidate will need a combination of troubleshooting, technical, and communication skills
• An AI Security Engineer must have the ability to take ownership and deliver multiple complex objectives which may include project and software development work
• Security reviews for AI/ML products, technologies, and services
• Secure design, architecture, and implementation of AI/ML systems
• Secure development life-cycle (SDLC) practices including threat modeling and security testing
• Influence decision-makers and stakeholders throughout the organization in multiple teams to achieve a consistently high security bar
• Lead penetration testing engagements and create new testing methods and exploits
• Create security guidance and documentation
• Develop security tools and automation
• Develop and deliver security training and outreach to internal development teams
• Develop and improve metrics that drive desired behavior and security outcomes
• Lead security projects (including security reviews, tool development, and creation of new security practices) with end-to-end ownership
• Support for mentoring, team building and recruiting activities