Log In
Sign Up
Amazon’s Payments Security organization is seeking a seasoned security engineer to drive strategic security initiatives across a portfolio of payment products serving MENA (Middle East and North Africa) and India. With a strong foundation on application security and cloud technologies, you will be in charge of all aspects of product security, ranging from the applications and their underlying infrastructure to product workflows, access mechanisms, threat detection and prevention controls, and incident response scenarios. You must thrive in high-pressure situations, think both like an attacker and a defender, and drive relevant teams to take appropriate actions within the right timeframes to mitigate risks to design secure products.
You must have passion towards developing novel solutions for complex security challenges, and towards discovering and remediating security risks across the full software stack (and its ecosystem). The ability to quickly design and build internal-facing tools that enable scaled programmatic automation is a must. We value broad and deep technical knowledge in fields of application security, identity and access management, malware analysis, security operations, and security intelligence. You will balance your efforts between strategic and operational deliverables, while working with talented engineering teams within Amazon to ensure products are designed and built securely. The successful candidate must be autonomous, comfortable in highly ambiguous situations, and must deliver results in a fast-paced environment.
You should be able to:
* Perform security reviews including secure design and architecture, threat modeling, threat assessments, secure code reviews, security testing, and security certifications.
* Identify security gaps in applications, services, and products including internally developed, as well as third party solutions.
* Determine findings criticality taking into account the relevant business, technical, and threat environment.
* Produce reports that describes the work perform for a variety of audiences including technical and non-technical stakeholders.
* Design, develop, deploy, and maintain security automation, secure-by-default solutions, and other solutions that will enable developer and security engineering productivity using scripting or programming languages.
* Develop a broad and deep technical understanding of the services, architectures, and products pertaining to Amazon’s payment ecosystem.
* Contribute to the long-term and short-term security strategy to ensure that applications are designed and built securely.
* Influence decision-makers and stakeholders to achieve a consistently high security bar.
* Create relevant documentation, security guidance, and metrics to report to your stakeholders and business leaders and deliver these in a clear, concise manner.
* Deliver practical security solutions providing a customer-centric experience.
* Build security utilities and tools that enable security operations at high speed and wide scale. Develop detections and alerts to identify potential incidents.
* Analyze logging and alerting infrastructure to ensure appropriate coverage and response capability.
* Evaluate impact of current security trends, advisories, publications, and academic research. Coordinate responses as necessary across affected teams.
* Communicate effectively at multiple levels of sensitivity to multiple audiences.
* Recognize, adopt and instill best security engineering practices throughout the organization.
* Participate in security escalations support including on-call rotation.
We are open to hiring candidates to work out of one of the following locations:
Bengaluru, KA, IND | Chennai, TN, IND
* BS/B.Tech in Computer Science, Information Security, or equivalent professional experience.
* 8+ years of experience in application security, product security, or systems security.
* 5+ years writing production-level code in at least one scripting or compiled language such as Java, Python, JavaScript, Go, Ruby, C# or C/C++
* Proven experience in threat modeling, code reviews, security testing, vulnerability detection, attacker exploit techniques, and methods for their remediation.
* Strong technical understanding of OWASP Top 10 and application security concepts.
* 5+ years of experience securing cloud services, preferably AWS.
* A strong understanding of payments processing and financial services technologies.
* Master’s degree in Computer Science, Information Security, Computer Engineering or equivalent.
* Relevant industry certifications from SANS, GIAC, CISSP, OSCP, etc.
* 5+ years of software development experience with at least one programing language such as Java, Python, JavaScript, Go, Ruby, C# or C/C++.
* 3+ years of experience in penetration testing, offensive security, or red teaming.
* In-depth technical understanding of OWASP Top 10, and SANS 25 vulnerability identification and remediation.
* 5+ years of experience securing cloud services, preferably AWS, with an in-depth understanding of various cloud technologies.
* Experience with securing financial and payment processing systems, evaluating from Layer 3 to Layer 7 and with end-to-end security ownership.
* Excellent written and verbal communication skills with the ability to adapt messaging to technical and non-technical audiences at all levels including senior leadership.
* History of working autonomously and delivering results in a fast-paced, highly ambiguous environment.
* Experience driving multiple technically complex security initiatives while remaining effective at providing security guidance to stakeholders.
Amazon is an equal opportunity employer, and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, disability, age, or other legally protected status.
