Security Incident Response, Security Engineer, US Amazon Dedicated Cloud Security
Overview:
You can get further details about the nature of this opening, and what is expected from applicants, by reading the below. In this role you will detect and respond to threats against a highly secure, air-gapped government program. You will monitor telemetry, triage alerts, and drive incidents through containment, eradication, and recovery, shaping better detections and playbooks along the way. You’ll collaborate with detection engineers, SOC analysts, forensics, and government counterparts to keep a high-value system defensible around the clock. This is a hands-on role for someone who thrives on rapid containment and turning alarms into improvements, with a clear mission to protect customer trust and government interests. Compensation / Benefits Health insurance (medical, dental, vision)401(k) with matching Paid time off Parental leaveRSUs and sign-on options Career development and training opportunities
Responsibilities:
- Monitor security telemetry, triage alerts, investigate, and escalate on the disconnected platform
- Lead incidents through the full response lifecycle: containment, eradication, recovery, after-action
- Develop and tune detection content and response playbooks from incident learnings
- Coordinate incident reporting and handoffs with the ISSM and Government counterparts
Key requirements:
- Bachelor degree or equivalent security certifications listed in the adExperience triaging and developing security alerts and response automation
- Fundamentals of networking, security, databases, operating systems 3+ years scripting, programming, xhqgsiq and security code review 3+ years incident response, SOC, or security operations experience
- Active TS/SCI with Polygraph security clearance (must be current)
- Strong collaboration with cross-functional teams
- Effective communication and escalation
- Analytical problem-solving and situational awareness
- Security telemetry monitoring and incident triage
- Incident response and security operations
- Development of detection content and automated playbooks