Location
London

Hours
Full Time

Salary
Competitive, commensurate with experience

About the Role
AWS Security Assurance Services (SAS) is seeking a Senior Security & Compliance Engineer to lead the design, deployment, and implementation of complex AWS security and compliance solutions that meet customer-defined business and security outcomes at scale. You will build custom security controls, AI-enabled automation, and tooling that translate security and compliance frameworks into secure-by-design implementations on AWS. This role involves innovating for AWS's most highly regulated customers by designing and building controls, writing code, leading reviews, automating remediations, and owning security risk identification, mitigation, and engineering outcomes that span multiple teams. You will lead development of security and compliance solutions and products, influence partner organizations, and communicate security risks and design decisions clearly to technical and non-technical audiences. Travel to customer sites may be required.

About the Team
The AWS Security Assurance Services team, part of AWS Support, leverages deep expertise to establish scalable security solutions for internal and external customers. The team helps customers achieve, maintain, and automate compliance in the cloud by aligning audit standards with AWS service features. AWS SAS LLC is a PCI-QSAC and HITRUST External Assessor Firm working with AWS's largest enterprise customers to operationalize the shared responsibility model during cloud migration.

Experience
- 5+ years identifying security issues and risks and developing mitigation plans
- 4+ years scripting, programming, and security code review in common programming languages
- 4+ years cloud architecture and solution implementation experience or US government top secret clearance
- Experience managing full application stacks or working with REST API services
- Experience applying threat modeling or risk identification techniques
- Experience with security in service-oriented architectures, microservices, and web services
- Experience with application security frameworks, incident response, penetration testing, cloud security, AI security, identity and access controls
- Experience developing, deploying, and managing AI products at scale
- Experience in security or compliance consulting or advisory roles
- Experience designing or architecting scalable and reliable systems
- Experience with compliance and security standards including PCI DSS, ISO 27001, HIPAA, and NIST
- Strong programming and scripting skills in Python, TypeScript, Node.js, Go, Java, or .NET
- Advanced Infrastructure-as-Code proficiency in Terraform, AWS CDK, and/or CloudFormation
- Expert-level configuration and architectural experience with AWS security and governance services including Config, GuardDuty, Security Hub, Control Tower, Systems Manager, KMS, IAM, VPC, Lambda, CloudTrail, CloudWatch, and EventBridge
- Proven track record deploying SCPs and RCPs in multi-account AWS Organizations at enterprise scale
- Experience writing and deploying reusable policy-as-code patterns (cfn-guard, OPA Rego, Cedar, or equivalent)

About You
Detail-oriented and innovative security engineer with strong leadership skills. Able to communicate complex security risks and design decisions clearly to diverse audiences including technical teams and C-level executives. Passionate about building secure, scalable cloud solutions and automating compliance. Comfortable leading exploratory POCs and resolving escalations through root-cause analysis. Collaborative and customer-focused with a drive to influence product and service roadmaps.

Qualifications
- Bachelor's degree or higher in Computer Science, Engineering, Mathematics, or equivalent STEM field, or equivalent experience
- Proficiency in at least two programming languages such as Scala, Java, Python, C/C++, or Go
- Industry and AWS certifications strongly preferred, including CISSP, GCIH, GSEC, Security+, AWS Solutions Architect Professional, AWS Security Specialty
- Experience with secure coding, software development, and cloud security engineering
- Familiarity with policy-as-code tools and security automation frameworks