Amazon’s Threat Hunting team is looking for a Security Engineer, Threat Hunting who is excited by the idea of searching for and uncovering undetected threat activities at petabyte scale. In this role, you will work alongside other Threat Hunting engineers to proactively identify and eliminate threats wherever they may exist.

‍

If you are someone who enjoys researching threats, diving deep into large datasets, and building innovative capabilities to solve everyday problems, we’d like to meet you. Your work will be essential to maintaining customer trust and delivering a delightful experience for our customers.

‍

‍

‍

Key job responsibilities

- You will query and evaluate machine data for evidence of potentially damaging threat activities which pose a risk to Amazon customers and data.

- You will reconstruct security events using log data and identify opportunities to increase the fidelity of existing threat signals.

- You will conduct threat research and develop innovative approaches to identify threat actor tactics, techniques, and procedures (TTPs).

- You will provide ad hoc support to incident response partners and participate in validating the scope of ongoing security investigations.

- You will participate in an on-call rotation and provide ad hoc support to customers during non-business hours.

‍

‍

‍

Basic Qualifications

- Experience working as part of a computer Security Incident Response Team (CSIRT) or Product Security Incident Response Team (PSIRT)
- Experience triaging and developing security alerts and response automation, conducting front-line analysis, and providing escalation support
- Experience with common security monitoring, log analysis and forensic tools
- 1+ years professional (non-internship) experience within a relevant field

‍

‍

‍

Preferred Qualifications

- Experience with AWS Services including EC2, Lambda, S3, DynamoDB, SQS
- Experience with at least one modern language such as Java, Python, C++, or C# including object-oriented design
- 2+ years experience working as part of a computer Security Incident Response Team (CSIRT) or Product Security Incident Response Team (PSIRT)

‍