Security Engineer, Offensive Security, Finance Adversarial Threat Emulation - Amazon

Description The Finance Adversarial Threat Emulation (FATE) team is looking for a security engineer to perform red teaming and penetration testing on Finance Operations (e.g., Accounts Payable, Accounts Receivable, Payroll, Procurement, Amazon Travel and Events, and Global Real Estate and Facilities) infrastructure and applications. The scope of this role includes performing end to end full stack engagements - from scoping, to threat modeling, information gathering, discovery, vulnerability exploitation, lateral movement, post-exploitation, and executive reporting. Your engagements will include internal, external, web, mobile, and other environments. You will be responsible for working closely with many teams at Amazon, while testing their application environments. You will exhibit a strong sense of customer obsession and earn trust while working with these teams. You will be providing deep security expertise and insight to correctly identify and explain the security vulnerabilities and impact while working with business teams on remediation strategies. Key job responsibilities Perform full stack security testing on business units independently as well as within a team Perform red team campaigns of client systems, websites, and networks to discover high-quality vulnerabilities Thoroughly document exploit chain/proof of concept scenarios for client consumption Identify security monitoring weaknesses and recommend detection improvements Develop innovative and scalable tools, solutions, and processes to enhance the Offensive Security team's operations Communicate with VPs, Directors, and finance and technology leaders to prioritize and execute remediation plans About the team Our vision is to make Finance Operations assets the most difficult target to exploit by bad actors. We perform red team engagements and penetration testing on Finance Operations assets, including upstream and downstream systems. Basic Qualifications - Bachelor's degree in Computer Science or related field or equivalent experience - 2+ years of security engineering experience, including red teaming, penetration testing, vulnerability research, and manual code auditing for vulnerabilities Preferred Qualifications - Experience with physical red teaming, financial red teaming, hardware hacking, offensive IoT security, red teaming cloud environments, reverse engineering, payload development, social engineering, exploit development - Programming experience in Python, C/C++, JavaScript, .NET and/or other interpreted or compiled languages - Experience with red teaming and penetration testing best practices - Understanding of web application, networking, and cloud technologies - Experience with offensive security testing tools such as Cobalt Strike, C2 infrastructure, Nmap, and/or Burp Suite - Experience with Windows, Linux, and MacOS operating systems - Experience with implementing red team attack infrastructure - Experience with custom offensive security tool development Amazon is committed to a diverse and inclusive workplace. Amazon is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company's reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you're applying in isn't listed, please contact your Recruiting Partner. Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $125,500/year in our lowest geographic market up to $212,800/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits . This position will remain posted until filled. Applicants should apply via our internal or external career site.