AWS Senior Cyber Threat Intelligence Analyst - APT, AWS Threat Intelligence Group (ATIG)

Seattle, Washington, USA

Applications have closed

Amazon.com

Free shipping on millions of items. Get the best of Shopping and Entertainment with Prime. Enjoy low prices and great deals on the largest selection of everyday essentials and other products, including fashion, home, beauty, electronics, Alexa...

View company page

Job summary
The Amazon Web Services Threat Intel Group (ATIG) is responsible for developing actionable intelligence on advanced cyber threats to our services and our customers. We collect indicators and intelligence from a variety of internal and external sources and use that information to develop an understanding of high grade actors and their tools, techniques, and procedures. We then leverage that understanding to proactively identify and mitigate malicious activity.

The successful candidate will analyze indicators to generate actionable intelligence and insight into current threats. As a Cyber Threat Intelligence Analyst, you will help enhance our capabilities by formulating new analytic techniques and working across teams to drive the supporting capabilities. A deep understanding of current APT actors and TTPs as well as experience performing question driven analysis is required. You will use your solid understanding of networking and host based indicators and determine how to best leverage them. In addition, you will script and help automate recurring tasks to improve the overall effectiveness of the team. An understanding of operating systems internals will be an asset.

Inclusive Team Culture
Here at AWS, we embrace our differences. We are committed to furthering our culture of inclusion. We have ten employee-led affinity groups, reaching 40,000 employees in over 190 chapters globally. We have innovative benefit offerings, and we host annual and ongoing learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences. Amazon’s culture of inclusion is reinforced within our 14 Leadership Principles, which remind team members to seek diverse perspectives, learn and be curious, and earn trust.

Work/Life Balance
Our team also puts a high value on work-life balance. Striking a healthy balance between your personal and professional life is crucial to your happiness and success here, which is why we aren’t focused on how many hours you spend at work or online. Instead, we’re happy to offer a flexible schedule so you can have a more productive and well balanced life—both in and outside of work.

Mentorship & Career Growth
Our team is dedicated to supporting new members. We have a broad mix of experience levels and tenures, and we’re building an environment that celebrates knowledge sharing and mentorship. Our senior members enjoy one-on-one mentoring and thorough, but kind, code reviews. We care about your career growth and strive to assign projects based on what will help each team member develop into a better-rounded engineer and enable them to take on more complex tasks in the future.

Key job responsibilities
Key responsibilities include:
  • Perform deep dive analysis of malicious artifacts.
  • Analyze large and unstructured data sets to identify trends and anomalies indicative of malicious activities.
  • Create security techniques and automation for internal use that enable the team to operate at high speed and broad scale.
  • Provide situational awareness on the current threat landscape and the techniques, tactics and procedures associated with specific threats.
  • Pursue actionable intelligence on current threats as they relate to AWS.
  • Periodic on-call responsibilities.

Basic Qualifications


  • BS degree in Computer Science, Management of Information Systems (MIS), Computer Engineering, or 5+ years equivalent technology experience without a degree
  • 5 years experience with tracking APT groups and other high grade threats
  • 5 years experience in system, network, and/or application security
  • 5 years experience building automated tools in C, C++, Java, Python, Perl, PowerShell, or Ruby
  • 2 years experience with SQL or other query languages.

Preferred Qualifications

  • MS degree in Computer Science, Management of Information Systems (MIS), Computer Engineering
  • Strong understanding of Windows, Linux, and or OS X internals
  • Experience with malware analysis, network flow analysis and large scale data analysis.
  • Experience with AWS services.
  • Meets/exceeds Amazon’s leadership principles requirements for this role
  • Meets/exceeds Amazon’s functional/technical depth and complexity for this role


Amazon is committed to a diverse and inclusive workplace. Amazon is an equal opportunity employer and does not discriminate on the basis of race, national origin, gender, gender identity, sexual orientation, protected veteran status, disability, age, or other legally protected status. For individuals with disabilities who would like to request an accommodation, please visit https://www.amazon.jobs/en/disability/us.

* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰

Tags: Application security APT Automation AWS C Computer Science Java Linux Malware Perl PowerShell Python Ruby SQL Threat intelligence TTPs Windows

Perks/benefits: Career development Conferences Flex hours Team events

Region: North America
Country: United States
Job stats:  11  1  0

More jobs like this

Explore more InfoSec / Cybersecurity career opportunities

Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.