Vendor and partner onboarding — Run third-party security assessments for new technology partners and design isolated partner environments with least-privilege network and data access. Implement VPC segmentation, security groups and NACLs, Transit Gateway, AWS PrivateLink, client VPN, S3 bucket policies, and KMS encryption to enforce strict boundary controls.
Identity and access — Design and audit access controls across multiple cloud accounts. Cover AWS IAM roles and policies, SCPs, IAM Identity Center, Active Directory and LDAP, Linux directory integration (SSSD, Winbind, PAM, Kerberos), sudoers, SSH key and certificate management, bastion hosts, and VPN. Fix privilege-escalation paths and unauthenticated endpoints (OIDC/SAML, Amazon Cognito, ALB authentication).
Security automation — Build tools, dashboards, alerting, and AI-assisted agents that detect, explain, and fix security issues using Python, Bash, AWS Lambda, EventBridge, CloudWatch, CloudTrail, GuardDuty, Security Hub, and Amazon Bedrock. Turn repeated fixes into runbooks and reusable automation using infrastructure as code (AWS CDK, CloudFormation, Terraform, Ansible).
Threat modeling and design review — Review new infrastructure designs for security exposure using STRIDE and data-flow diagrams. Assess network ingress and egress, secrets handling (AWS Secrets Manager, KMS), TLS and certificate management, and logging coverage. Establish secure-by-default patterns that the broader team can adopt.
Reporting — Produce clear weekly security status updates with metrics: finding counts by severity, SLA adherence, backlog trajectory, and workstream status.
A day in the life
Each day you will work with some of the best engineers in the industry to develop Machine Learning Accelerators. On-site in Austin, Texas, you will be part of the team that develops custom silicon and contribute to the security of the infrastructure that enables this innovation.
You might start your day triaging new vulnerability findings from overnight scans, assessing severity scores, and coordinating with the engineering SMEs who own the affected systems. You could spend your morning reviewing a vendor security assessment for a new technology partner, designing the isolated network environment they'll operate in, and ensuring least-privilege access controls are in place. In the afternoon, you might be building an automated remediation pipeline that patches critical CVEs across a fleet of Linux hosts, or refining a dashboard that gives leadership real-time visibility into the team's security posture and SLA adherence.
You'll participate in threat modeling sessions for new infrastructure designs, contribute to postmortems when security incidents occur, and continuously harden the systems that accelerate the path from RTL to silicon. Throughout the day, you'll balance immediate security needs, such as driving an emergency patch for a critical vulnerability on production systems, with longer-term investments like building AI-assisted agents that detect and explain security issues before they become findings. You'll write code, review infrastructure-as-code changes for security exposure, and collaborate across teams who depend on the secure foundations you build.
Take a look inside our labs to see what you will learn at Annapurna Labs:
https://www.aboutamazon.com/news/aws/take-a-look-inside-the-lab-where-aws-makes-custom-chips
https://youtu.be/rViVFrQg4Hk
About the team
At Annapurna Labs, your security engineering work directly protects the infrastructure behind breakthrough innovations in custom silicon that power AWS and transform industries. The ML Infrastructure team builds and operates the compute, storage, networking, CI/CD, and developer platforms that hundreds of chip designers and verification engineers depend on daily. We offer the resources and scale of AWS with the innovation culture and technical depth of a focused silicon team.
If you're passionate about infrastructure security, thrive on building mechanisms that make teams more secure by default, and want to see your work protect the next generation of AWS silicon, we want to hear from you.
Experience as a mentor, tech lead or leading an engineering team
4+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
5+ years of work in identifying security issues and risks, and developing mitigation plans experience
Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
Experience working in identifying security issues and risks, and developing mitigation plans
Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language
Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools
Experience applying threat modeling or other risk identification techniques or equivalent
Experience with security in service-oriented architectures/microservices and web services
Experience architecting, securing, and operating Amazon Web Services
Experience leading or driving adoption of AI-assisted development practices to improve security outcomes
Experience in the full secure software development life cycle, including coding standards, code reviews, source control management, build processes, testing, and operations
Experience with any combination of the following: application security frameworks, identity and access controls, incident response, mobile security, cloud computing and security, AI security, threat intelligence, and penetration testing
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.
The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.
USA, TX, Austin - 178,400.00 - 226,700.00 USD annually
