AWS Security Operations/Incident Response Engineer

About the Role

Amazon Web Services (AWS) is seeking a focused Security Engineer to take on a leadership role in responding to security issues in support of our National Security program. This engineer will work as part of a growing team protecting the AWS infrastructure used by national security customers.

Key Responsibilities

• Confidently and intelligently respond to security incidents, and proactively consider how to prevent them in the future.
• Design and coordinate cohesive responses to security events that involve multiple teams.
• Build security utilities and tools for internal use to operate at high speed and wide scale.
• Communicate effectively at multiple levels of sensitivity and to multiple audiences.
• Recognize, adopt, and instill best practices in security engineering fields: development, cryptography, network security, security operations, incident response, and security intelligence.
• Fulfill regular on-call responsibilities.

A Day in the Life

Your day involves scanning overnight security telemetry, triaging alerts, and investigating anomalies. When an incident occurs, you will analyze logs, run forensics, coordinate responses, and inform leadership. Between investigations, you will build tooling to enhance detection and response capabilities, weigh technical risks against business needs, and share on-call duty.

Requirements & Tech Stack

• Log analysis
• Incident response
• Forensics
• System/tooling development
• Risk assessment
• Ability to thrive in high-pressure situations.
• Ability to think like both an attacker and defender.
• Ability to drive relevant teams to take appropriate actions to mitigate risks.
• Ability to balance technical risks against business needs.
• Ability to articulate risks and mitigations to leadership.
• Deep technical knowledge and a demonstrated background in information security.
• Broad and deep technical knowledge in fields such as cryptography, network security, software security, malware analysis, forensics, security operations, incident response, and emergent security intelligence.

Qualifications

• Associate's degree or above, OR GCIH (GIAC Certified Incident Handler), OR GSEC (GIAC Security Essentials), OR Security+.
• Current, active US Government Security Clearance of TS/SCI with Polygraph.
• US Citizen.

Preferred Qualifications

• Experience with AWS products and services.