> Markdown version of [/jobs/ext/2573319-security-controls-engineer](https://www.wearedevelopers.com/jobs/ext/2573319-security-controls-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Controls Engineer

- **Company:** Amazon.com, Inc.
- **Location:** Tempe, AZ, United States (Remote available)
- **Experience:** Experienced
- **Salary:** $81,800.0 - $118,600.0
- **Contract:** Permanent contract
- **Skills:** Amazon Web Services, JIRA, Microsoft Azure, Cloud Computing Security, Continuous Integration, DevOps, Identity and Access Management, PCI Data Security Standards, Systems Development Life Cycle, Runbook, Software Vulnerability Management, Cloud Platform System, Software Security, Control Language, Information Technology, Patch Management, Static Application Security Testing, Vulnerability Analysis, Dynamic Application Security Testing
- **Published:** August 1, 2026
- **Apply:** https://www.careerjet.com/job/usa29cb73801f4c22d5eb2bd21309e42ba/eaa

## About the Role

A degree in Information Technology or a related field, ideally with a focus on cybersecurity, is an advantage.
3+ years of experience in vulnerability management, security engineering, or security program delivery in a cloud/software environment.
Demonstrated ability to work independently and drive outcomes across multiple teams.
Working understanding of regulatory security requirements and demonstrated experience with common frameworks/regulations implementation (e.g., ISO 27001, NIS2, SOC 2, GDPR, PCI DSS).
Strong translation skills: turn policy and control language into developer-ready user stories, acceptance criteria, remediation tasks, and runbooks.
Hands-on experience using work tracking tools (Jira, Azure DevOps, etc.) and crafting status reports/dashboards for leadership.
Strong communication skills: comfortable analyzing vulnerability trends, including ageing, patch latency, and systemic root causes, supported by concise writing ability, clear meeting facilitation, and demonstrated experience with stakeholder alignment.
Understanding of modern SDLC/DevOps practices (CI/CD, IaC, pipelines, change management).
Experience in cloud environments (AWS/Azure/GCP), including shared responsibility and guardrail patterns.
Wry sense of humor is a plus

## Description

We're looking for an independent, driven security professional who thrives at the intersection of security, DevOps, and delivery. In this role, you will translate legal and security framework requirements into clear, actionable vulnerability management and remediation programs that operate across multiple Security and DevOps teams. You'll help design, operationalize, and continually improve our vulnerability management lifecycle, from identification and triage through prioritization and remediation to validation and reporting. This includes secure development practices within regulatory frameworks guiding vulnerability handling, coordinated disclosure, SBOM transparency, patch management, and post-deployment monitoring. You will track, report, and escalate progress, risks, and dependencies, partnering closely with a Senior Project Manager and reporting to senior leadership.
If you enjoy making complex requirements practical, measurable, and delivered-this is for you., Translate requirements * action: Break down legal, regulatory (including Cyber Resiliency Act), and security framework obligations into prioritized, testable tasks for engineering and platform teams. Define concrete technical control requirements across vulnerability detection, remediation SLAs, secure configuration baselines, SBOM management, and coordinated disclosure processes.
Own the vulnerability management lifecycle: Drive end-to-end vulnerability management across infrastructure, cloud, applications, containers, and third-party components-including scanning, triage, risk-based prioritization (CVSS + exploitability + business impact), remediation tracking, validation, and closure.
Integrate security into CI/CD: Partner closely with the Application Security team to support SAST, DAST, SCA, container, IaC, and cloud configuration scanning into CI/CD pipelines. Ensure findings are automatically ticketed, risk-ranked, and tracked to resolution with measurable SLAs.
Orchestrate implementation: Coordinate work across multiple security domains (e.g., IAM, vuln mgmt, cloud security, appsec) and DevOps/Platform teams to drive consistent adoption.
Plan & track delivery: Build delivery plans, track milestones, manage dependencies, and maintain a single source of truth (e.g., Jira/Azure Boards).
Stakeholder management: Align with product owners, architects, and security SMEs; resolve blockers and facilitate decisions.
Metrics & reporting: Develop actionable dashboards that show vulnerability aging, SLA compliance, backlog trends, recurring vulnerability patterns, report status, risk exposure, and remediation plans to senior leadership in concise dashboards.
Control mapping & evidence: Help map vulnerability management practices to regulatory frameworks and collect/curate evidence for audits.
Continuous improvement: Standardize templates, automate playbooks and evidence collection, and reduce manual triage effort to advance processes and program maturity.
Partner with PM: Work hand-in-hand with a Senior PM to align scope, timelines, compliance deadlines, and cross-team execution., Technical Aptitude Interview
Cross-Functional Stakeholder Interview
Final Round Interview
Gen is an equal opportunity employer, and we're committed to fair, inclusive practices at every stage of the candidate and employee journey. Employment decisions are based on merit, experience and business needs.


## Related Videos

- [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers)
- [Technical Documentation - How Can I Write Them Better and Why Should I Care?](https://www.wearedevelopers.com/videos/681-technical-documentation-how-can-i-write-them-better-and-why-should-i-care)
- [From DevOps to Scaled DevOps: How We’re Rebuilding Continuous Delivery as a Platform](https://www.wearedevelopers.com/videos/100018-from-devops-to-scaled-devops-how-we-re-rebuilding-continuous-delivery-as-a-platform)
- [Improving quality with Agentic AI with Rovo Dev and Xray](https://www.wearedevelopers.com/videos/2005-improving-quality-with-agentic-ai-with-rovo-dev-and-xray)
- [3 Key Steps for Optimizing DevOps Workflows](https://www.wearedevelopers.com/videos/962-3-key-steps-for-optimizing-devops-workflows)
- [You can’t hack what you can’t see](https://www.wearedevelopers.com/videos/41-you-can-t-hack-what-you-can-t-see)

## Related Articles

- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [What Are The Top Skills Required For Azure Developers?](https://www.wearedevelopers.com/magazine/77-what-are-the-top-skills-required-for-azure-developers)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)