Do you want to be on the front lines of customer security, responding to the most complex and novel security incidents in the cloud? Are you skilled at performing incident response activities and passionate about helping customers during their worst day? Are you excited to turn incident insights into automation that scales AWS Security's impact? Do you thrive in fast-paced, high-stakes situations where your expertise directly protects customers?

As a member of AWS CIRT (Customer Incident Response Team) within the AWS CISO Office, you will be AWS's final escalation point for customer cloud security incidents. You'll respond to complex, novel, and large-scale security events through our Zipline mechanism, partner with threat intelligence and detection teams, and help build the automation and playbooks that enable AWS to respond faster than threat actors. Building on those experiences, you'll contribute insights that drive service improvements across AWS and help shape how security incident response is practiced at planetary scale.

Key job responsibilities
• Perform incident response for complex, novel, and large-scale customer security events via the Zipline mechanism

• Serve as a deep technical resource that earns the trust of customers before, during, and after security incidents

• Capture and analyze incident data to contribute intelligence to AWS Security leadership and service teams

• Design, build, and deploy automation to reduce manual incident response effort and enable faster response

• Develop playbooks and runbooks that enable AWS SIR and other teams to handle incident patterns at scale

• Contribute to the Zipline volunteer program by training and mentoring responders across AWS Security

• Support the CISO Office with incident data, insights, and situational awareness for large-scale events

• Innovate on behalf of customers by asking "what would have to be true?" to eliminate manual work and improve outcomes

• Participate in 24x7 on-call rotation for incident response coverage

About the team
The AWS Customer Incident Response Team (CIRT), part of the AWS CISO Office, is the guardian of the customer security experience when it matters most. We are AWS's final escalation point for customer security incidents - handling the complex, novel, and large-scale events that require deep expertise.

We are security builders, not just responders. Our mission is to help customers having their worst day in the cloud, capture insights to drive service improvements, and scale our impact by enabling teams across AWS to respond effectively.