Security Engineer

Description

We're looking for a Security Engineer to own the security posture of the cloud and hybrid infrastructure that powers silicon development at Annapurna Labs. You'll be a single-threaded security partner embedded in the ML Infrastructure team, working directly alongside software development engineers, system development engineers, and chip methodology engineers to keep the infrastructure that hundreds of chip designers depend on secure, compliant, and hardened against emerging threats.

This is a high-ownership role where you'll operate across the full security lifecycle: triaging and driving critical findings to resolution, building automated scanning and patching mechanisms, designing secure network architectures for vendor and partner onboarding, and turning repeated fixes into reusable automation and runbooks. You'll make security a seamless part of how the team builds and ships, not a gate that slows them down.

Key job responsibilities
• Vulnerability management — Own the security findings backlog end to end. Triage findings from security scanners and assessments (CVE/CVSS scoring, container and host scanning such as AWS Inspector), coordinate remediation with the engineering SMEs who own the affected systems, mitigate high-severity issues within agreed timelines, and drive measurable reduction of long-standing findings.
• Patching Automation — Keep server fleets (RHEL/Rocky Linux, Amazon Linux, and Windows Server, cloud and on-premises) current on critical security updates. Own and improve patching pipelines using dnf/yum, AWS Systems Manager Patch Manager, and golden-AMI pipelines, including emergency vendor patches on production systems. Establish a regular patching cadence and structurally eliminate recurring patch-drift findings.
• Vendor and partner onboarding — Run third-party security assessments for new technology partners and design isolated partner environments with least-privilege network and data access. Implement VPC segmentation, security groups and NACLs, Transit Gateway, AWS PrivateLink, client VPN, S3 bucket policies, and KMS encryption to enforce strict boundary controls.
• Identity and access — Design and audit access controls across multiple cloud accounts. Cover AWS IAM roles and policies, SCPs, IAM Identity Center, Active Directory and LDAP, Linux directory integration (SSSD, Winbind, PAM, Kerberos), sudoers, SSH key and certificate management, bastion hosts, and VPN. Fix privilege-escalation paths and unauthenticated endpoints (OIDC/SAML, Amazon Cognito, ALB authentication).
• Security automation — Build tools, dashboards, alerting, and AI-assisted agents that detect, explain, and fix security issues using Python, Bash, AWS Lambda, EventBridge, CloudWatch, CloudTrail, GuardDuty, Security Hub, and Amazon Bedrock. Turn repeated fixes into runbooks and reusable automation using infrastructure as code (AWS CDK, CloudFormation, Terraform, Ansible).
• Threat modeling and design review — Review new infrastructure designs for security exposure using STRIDE and data-flow diagrams. Assess network ingress and egress, secrets handling (AWS Secrets Manager, KMS), TLS and certificate management, and logging coverage. Establish secure-by-default patterns that the broader team can adopt.
• Reporting — Produce clear weekly security status updates with metrics: finding counts by severity, SLA adherence, backlog trajectory, and workstream status.

A day in the life
Each day you will work with some of the best engineers in the industry to develop Machine Learning Accelerators. On-site in Austin, Texas, you will be part of the team that develops custom silicon and contribute to the security of the infrastructure that enables this innovation.
You might start your day triaging new vulnerability findings from overnight scans, assessing severity scores, and coordinating with the engineering SMEs who own the affected systems. You could spend your morning reviewing a vendor security assessment for a new technology partner, designing the isolated network environment they'll operate in, and ensuring least-privilege access controls are in place. In the afternoon, you might be building an automated remediation pipeline that patches critical CVEs across a fleet of Linux hosts, or refining a dashboard that gives leadership real-time visibility into the team's security posture and SLA adherence.

You'll participate in threat modeling sessions for new infrastructure designs, contribute to postmortems when security incidents occur, and continuously harden the systems that accelerate the path from RTL to silicon. Throughout the day, you'll balance immediate security needs, such as driving an emergency patch for a critical vulnerability on production systems, with longer-term investments like building AI-assisted agents that detect and explain security issues before they become findings. You'll write code, review infrastructure-as-code changes for security exposure, and collaborate across teams who depend on the secure foundations you build.

Take a look inside our labs to see what you will learn at Annapurna Labs:
• https://www.aboutamazon.com/news/aws/take-a-look-inside-the-lab-where-aws-makes-custom-chips
• https://youtu.be/rViVFrQg4Hk


About the team
At Annapurna Labs, your security engineering work directly protects the infrastructure behind breakthrough innovations in custom silicon that power AWS and transform industries. The ML Infrastructure team builds and operates the compute, storage, networking, CI/CD, and developer platforms that hundreds of chip designers and verification engineers depend on daily. We offer the resources and scale of AWS with the innovation culture and technical depth of a focused silicon team.
If you're passionate about infrastructure security, thrive on building mechanisms that make teams more secure by default, and want to see your work protect the next generation of AWS silicon, we want to hear from you.

Basic Qualifications

- Experience as a mentor, tech lead or leading an engineering team
- 4+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
- 5+ years of work in identifying security issues and risks, and developing mitigation plans experience
- Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
- Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
- 4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
- Experience working in identifying security issues and risks, and developing mitigation plans
- Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language
- Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools

Preferred Qualifications

- Experience applying threat modeling or other risk identification techniques or equivalent
- Experience with security in service-oriented architectures/microservices and web services
- Experience architecting, securing, and operating Amazon Web Services
- Experience leading or driving adoption of AI-assisted development practices to improve security outcomes
- Experience in the full secure software development life cycle, including coding standards, code reviews, source control management, build processes, testing, and operations
- Experience with any combination of the following: application security frameworks, identity and access controls, incident response, mobile security, cloud computing and security, AI security, threat intelligence, and penetration testing

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.