Manager III, Security Engineer, AWS Vulnerability Management - Third Party Software and Software Supply Chain

You will lead a team focused exclusively on third-party software and software supply chain vulnerabilities across AWS and the broader Amazon ecosystem. This role emphasizes building long-term defense through end-to-end vulnerability mitigation, automated remediation, and measurable reductions in risk exposure. You’ll also apply generative AI tooling to speed up vulnerability analysis and remediation workflows, without requiring a human in the loop for execution.

This position is based in Austin, TX (onsite). The salary range is USD 175,100 - 236,900 per year.

What you’ll do

• Own the end-to-end vulnerability mitigation strategy for third-party software across Amazon, including setting goals and metrics to drive measurable risk reduction.
• Design and build auto-remediation capabilities to resolve vulnerabilities at machine speed using vulnerability scanning data and defense-in-depth principles, with safe updates across the fleet without manual intervention.
• Lead and grow an inclusive team of 11 software development engineers and security engineers through collaborative planning, coaching, and strategic assignments aligned to individual career goals.
• Partner with AWS service teams and Amazon Security peers to analyze unpublished vulnerabilities in open source software, develop threat models, and implement guardrails that prevent vulnerable packages from entering the fleet.
• Accelerate workflows with generative AI tooling and establish data-driven reporting to keep leadership informed on progress and outcomes.

Day to day

• Review vulnerability scanning data and triage emerging third-party risks with your security and engineering team.
• Collaborate with AWS service teams to align on remediation rollouts for open source dependencies.
• Conduct design reviews to iterate on new auto-remediation capabilities.
• Run one-on-ones with direct reports to discuss growth and development.
• Draft narratives that communicate your team’s progress and strategy to senior leadership.

Requirements

• 5+ years of managing and developing teams experience
• 5+ years of progressive work within a software security team or related operating environment experience
• Bachelor’s degree in Computer Science, Information Security, or a related field
• Experience triaging security risks or vulnerabilities and ensuring they are understood by the business and fixed or mitigated
• Knowledge of security of web services, video content protection technologies, cryptography, network security protocols, and operating system security
• Experience applying threat modeling or other risk identification techniques (or equivalent)

Preferred qualifications

• Master’s degree in Computer Science or a related field
• Experience with vulnerability risk and impact assessment
• Information security professional certification (for example SANS GIAC, CISSP)
• Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques
• Experience managing remote team members

Benefits

• Health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance, and an option for Supplemental life plans)
• EAP, Mental Health Support, Medical Advice Line
• Flexible Spending Accounts
• Adoption and Surrogacy Reimbursement coverage
• 401(k) matching
• Paid time off
• Parental leave

Work/life balance: Flexible work hours and arrangements are part of the culture.