We're looking for a Security Engineer to own the security posture of the cloud and hybrid infrastructure that powers silicon development at Annapurna Labs. You'll be a single-threaded security partner embedded in the ML Infrastructure team, working directly alongside software development engineers, system development engineers, and chip methodology engineers to keep the infrastructure that hundreds of chip designers depend on secure, compliant, and hardened against emerging threats. This is a high-ownership role where you'll operate across the full security lifecycle: triaging and driving critical findings to resolution, building automated scanning and patching mechanisms, designing secure network architectures for vendor and partner onboarding, and turning repeated fixes into reusable automation and runbooks. You'll make security a seamless part of how the team builds and ships, not a gate that slows them down. Key job responsibilities • Vulnerability management — Own the security findings backlog end to end. Triage findings from security scanners and assessments (CVE/CVSS scoring, container and host scanning such as AWS Inspector), coordinate remediation with the engineering SMEs who own the affected systems, mitigate high-severity issues within agreed timelines, and drive measurable reduction of long-standing findings. • Patching Automation — Keep server fleets (RHEL/Rocky Linux, Amazon Linux, and Windows Server, cloud and on-premises) current on critical security updates. Own and improve patching pipelines using dnf/yum, AWS Systems Manager Patch Manager, and golden-AMI pipelines, including emergency vendor patches on production systems. Establish a regular patching cadence and structurally eliminate recurring patch-drift findings. • Vendor and partner onboarding — Run third-party security assessments for new technology partners and design isolated partner environments with least-privilege network and data access. Implement VPC segmentation, security groups and NACLs, Transit Gateway, AWS PrivateLink, client VPN, S3 bucket policies, and KMS encryption to enforce strict boundary controls. • Identity and access — Design and audit access controls across multiple cloud accounts. Cover AWS IAM roles and policies, SCPs, IAM Identity Center, Active Directory and LDAP, Linux directory integration (SSSD, Winbind, PAM, Kerberos), sudoers, SSH key and certificate management, bastion hosts, and VPN. Fix privilege-escalation paths and unauthenticated endpoints (OIDC/SAML, Amazon Cognito, ALB authentication). • Security automation — Build tools, dashboards, alerting, and AI-assisted agents that detect, explain, and fix security issues using Python, Bash, AWS Lambda, EventBridge, CloudWatch, CloudTrail, GuardDuty, Security Hub, and Amazon Bedrock. Turn repeated fixes into runbooks and reusable automation using infrastructure as code (AWS CDK, CloudFormation, Terraform, Ansible). • Threat modeling and design review — Review new infrastructure designs for security exposure using STRIDE and data-flow diagrams. Assess network ingress and egress, secrets handling (AWS Secrets Manager, KMS), TLS and certificate management, and logging coverage. Establish secure-by-default patterns that the broader team can adopt. • Reporting — Produce clear weekly security status updates with metrics: finding counts by severity, SLA adherence, backlog trajectory, and workstream status. A day in the life Each day you will work with some of the best engineers in the industry to develop Machine Learning Accelerators. On-site in Austin, Texas, you will be part of the team that develops custom silicon and contribute to the security of the infrastructure that enables this innovation. You might start your day triaging new vulnerability findings from overnight scans, assessing severity scores, and coordinating with the engineering SMEs who own the affected systems. You could spend your morning reviewing a vendor security assessment for a new technology partner, designing the isolated network environment they'll operate in, and ensuring least-privilege access controls are in place. In the afternoon, you might be building an automated remediation pipeline that patches critical CVEs across a fleet of Linux hosts, or refining a dashboard that gives leadership real-time visibility into the team's security posture and SLA adherence. You'll participate in threat modeling sessions for new infrastructure designs, contribute to postmortems when security incidents occur, and continuously harden the systems that accelerate the path from RTL to silicon. Throughout the day, you'll balance immediate security needs, such as driving an emergency patch for a critical vulnerability on production systems, with longer-term investments like building AI-assisted agents that detect and explain security issues before they become findings. You'll write code, review infrastructure-as-code changes for security exposure, and collaborate across teams who depend on the secure foundations you build. Take a look inside our labs to see what you will learn at Annapurna Labs: • https://www.aboutamazon.com/news/aws/take-a-look-inside-the-lab-where-aws-makes-custom-chips • https://youtu.be/rViVFrQg4Hk About the team At Annapurna Labs, your security engineering work directly protects the infrastructure behind breakthrough innovations in custom silicon that power AWS and transform industries. The ML Infrastructure team builds and operates the compute, storage, networking, CI/CD, and developer platforms that hundreds of chip designers and verification engineers depend on daily. We offer the resources and scale of AWS with the innovation culture and technical depth of a focused silicon team. If you're passionate about infrastructure security, thrive on building mechanisms that make teams more secure by default, and want to see your work protect the next generation of AWS silicon, we want to hear from you.