Information Systems Security Engineer (ISSE)

Amazon Leo is a constellation of Low Earth Orbit satellites that will provide low-latency, high-speed broadband network connectivity to unserved and underserved communities around the world.

We are seeking a Senior Information Systems Security Engineer (ISSE) to raise the security bar for a portfolio of classified national security systems. You will work backward from mission and authorization outcomes, translate complex security requirements into practical engineering decisions, and own security across the full system lifecycle - from concept and architecture through assessment, authorization, operations, change, and decommissioning.

This is a senior individual-contributor role for an engineer who can operate independently in ambiguous environments, dive into technical details, and influence system owners, architects, developers, operations teams, ISSMs/ISSOs, assessors, and authorizing officials. You will balance immediate mission needs with durable security controls, automate recurring work, and communicate risk clearly to technical and senior leadership audiences.

The successful candidate has both breadth and depth: hands-on knowledge of operating systems, networks, cloud and virtualization, identity, logging, vulnerability management, cryptography, and secure architecture, combined with demonstrated mastery of the Risk Management Framework (RMF) for classified systems. This position requires that the candidate selected be a US Citizen and must currently possess and maintain an active TS/SCI security clearance.

Key job responsibilities

• Own end-to-end security engineering for multiple concurrent classified systems and enclaves, establishing priorities, schedules, risks, dependencies, and decision pathds with minimal direction.
• Lead system security architecture and design reviews; define security requirements, trust boundaries, control allocation, data flows, threat models, and defense-in-depth strategies for on-premises, cloud, hybrid, and disconnected environments.
• Drive RMF activities through authorization and continuous monitoring, including categorization, control tailoring, implementation guidance, assessment readiness, risk acceptance packages, significant-change analysis, and authorization maintenance.
• Develop and maintain high-quality authorization evidence, including system security plans, control implementation statements, security control traceability matrices, architecture diagrams, hardware/software inventories, test plans, assessment artifacts, risk assessments, plans of action and milestones, and continuous-monitoring records.
• Partner with system owners, ISSMs, ISSOs, architects, administrators, developers, security control assessors, authorizing officials, customers, and facility/industrial-security teams to resolve findings and make well-reasoned risk decisions.
• Engineer and validate secure configurations using applicable government security standards and baselines.
• Lead technical investigations of vulnerabilities, incidents, control failures, and anomalous results for the applicable environments; determine root cause, assess mission impact, define containment and remediation, and create mechanisms that prevent recurrence.
• Build automation, reusable templates, dashboards, and quality checks that reduce manual effort, shorten authorization cycle time, improve evidence consistency, and provide leadership with actionable measures of residual risk.
• Make and document security trade-offs that distinguish non-negotiable risk from reversible decisions; escalate clearly when mission, schedule, and security objectives conflict.
• Mentor engineers and security practitioners, conduct peer reviews, raise documentation and engineering standards, and serve as a trusted technical resource across programs.

A day in the life

You may begin by documenting a proposed architecture change for a classified enclave, then lead a working session to close assessment findings, validate a control implementation against technical evidence, and brief leadership on the risk of a schedule decision. Later, you might automate an evidence-quality check, review vulnerability trends across the portfolio, coach an engineer through a difficult control interpretation, or coordinate with an assessor before an authorization milestone. You move comfortably between technical depth, program judgment, and concise executive communication.

About the team

Leo Security protects the people, facilities, hardware, supply chain, and classified communications behind a global satellite constellation. The ISSE function within this team owns the security architecture, administration and compliance of all Leo classified networks. The team works directly with engineering, program security, and government customers to architect and maintain secure sensitive networks across ALG sites. Basic qualifications

• 4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
• 5+ years of work in identifying security issues and risks, and developing mitigation plans experience
• 4+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
• Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language
• Experience as a mentor, tech lead or leading an engineering team

Preferred qualifications

• Experience applying threat modeling or other risk identification techniques or equivalent
• 10+ years of relevant experience, including technical leadership as a senior ISSE, security architect, ISSM, lead ISSO, security control assessor, or equivalent role supporting high-impact national security missions.
• Advanced knowledge in at least two security domains, such as cloud security, zero trust, identity, secure networking, cross-domain solutions, platform hardening, cryptography/key management, detection engineering, software security, or incident response.
• Experience securing AWS or another major cloud platform in regulated or isolated environments, including infrastructure as code, cloud-native logging, IAM, network segmentation, and continuous control monitoring.
• Proficiency in Python, PowerShell, Bash, or another scripting language used to automate security validation, reporting, evidence collection, or operational workflows.
• One or more relevant certifications aligned to the assigned work role and program needs, such as CISSP, ISC2 CGRC, SecurityX (formerly CASP+), CCSP, CISM, GIAC certifications, or an approved cloud-security certification. Certification alone does not replace formal DoDM 8140.03 work-role qualification.
• Experience developing metrics that connect security activity to risk reduction, assessment quality, remediation aging, authorization health, or engineering efficiency.

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

…