AWS Application Security Manager, AWS Proactive Security

Help us protect not only the Amazon Web Services (AWS) cloud computing environment, but every customer who builds on it. AWS Security works at the forefront of the hardest problems in cloud, identity, and application security — all operating at a scale few engineers ever encounter. Our team is highly collaborative and deeply invested in each other's growth as the business grows.

Within AWS Proactive Security, our Application Security teams make sure AWS launches new products, services, and features securely. We are looking for a Security Engineering Manager to lead a team of application security engineers responsible for security reviews, threat modeling, and hands-on security evaluations across a portfolio of AWS's largest customer-facing sales, partner, and field organizations. You will own the security posture for your area, guide penetration test coordination, and set the strategy for how your team raises the security bar — while remaining flexible as ownership evolves across our organization.

This role pairs long-term strategic planning with the challenge of reacting quickly to new threat scenarios. You will set direction for a team of security professionals, evolve the security assurance process they run on, and — critically — define how we measure whether that process is actually working. As we transform the role of security from a point-in-time gate into a continuous, outcome-driven discipline, you will be responsible for building the metrics and data analysis that show how your team is performing, where the risk actually lies, and whether the security bar is rising over time.

As a Security Engineering Manager, you speak authoritatively on behalf of your team, and your technical knowledge demonstrates both depth and breadth. You are responsible for your team's structure and how it operates within the larger AWS Security organization — leveraging the strengths of individual engineers, delegating appropriately, and managing delivery of long-term projects. You have deep knowledge in application security, are a sought-after thought leader across the organization, and actively participate in the organization's planning processes. You will provide clear technical direction and risk-mitigation guidance to engineering and business leaders at every level, and you will be comfortable diving into complex engineering discussions to ensure proper risk assessment and threat analysis is performed.

Measurement is central to this role. You will define metrics that quickly and accurately present your team's performance and variance against its goals, use data to understand input drivers and where to invest, and communicate status and results effectively across the division. You will coordinate and contribute to cross-AWS security initiatives, and you will foster the professional growth of your engineers — seeking out stretch assignments and developing the next generation of security leaders on your team.

• Key job responsibilities
• - Lead, grow, and organize a team of application security engineers, and own their professional development
• - Set the strategy for raising the application security bar across your area, and evolve the security assurance process your team operates
• - Define metrics and data analysis to measure team performance, security outcomes, and whether the security bar is rising — moving beyond activity counts to demonstrated risk reduction
• - Own security reviews, threat modeling, and penetration test coordination for your portfolio
• - Drive and contribute to cross-AWS security initiatives, communicating status and results across the organization
• - Manage recruiting, team composition, and hiring bar for your area
• - Identify and deliver process and operational improvements that scale the team's review capacity
• - Directly represent the organization to business leaders and technical staff at all levels
• - Demonstrate reliable judgment, integrity, business acumen, and mature communication skills

• A day in the life
• -Reviewing your team's active security reviews and threat models, unblocking engineers and weighing in on the highest-risk or most ambiguous findings
• -Digging into the data on how your team is performing — review throughput, SLA adherence, finding quality, and risk reduced — and deciding where to invest next
• -Coaching and developing your engineers through 1:1s, stretch assignments, and hands-on technical guidance
• -Partnering with service and business teams to guide penetration test coordination and drive remediation of security issues
• -Providing clear technical direction and risk-mitigation guidance to engineering and business leaders across the organization
• -Setting and evolving the strategy for how your team raises the application security bar as the business grows and threats change
• -Contributing to cross-AWS security initiatives and representing your team's work and results to leadership
• -Diving into complex engineering discussions to ensure proper risk assessment and threat analysis is performed

• About the team
• Diverse Experiences
• Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying.

• Why Amazon Security?
• At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores.

• Inclusive Team Culture
• In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices.

• Training & Career Growth
• We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional.

• Work/Life Balance
• We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve.

Basic qualifications

• - 5+ years of managing and developing teams experience
• - 5+ years of progressive work within a software security team or related operating environment experience
• - Bachelor's degree in Computer Science, Information Security, or a related field
• - Knowledge of security of web services, video content protection technologies, cryptography, network security protocols and operating system security
• - Experience in progressive work within a software security team or related operating environment
• - Experience applying threat modeling or other risk identification techniques or equivalent

Preferred qualifications

• - CCSP (Certified Cloud Security Professional) or CEH (Certified Ethical Hacker) or CFR (CyberSec First Responder) or Cloud+ or CySA+ (CompTIA Cybersecurity Analyst) or GCED (GIAC Certified Enterprise Defender) or GICSP (Global Industrial Cyber Security Professional) or PenTest+
• - Master's degree in Computer Science or a related field
• - Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques
• - Experience managing remote team members

Amazon is an equal opportunity employer and does not discriminate on the basis of protect