Network Security Engineering Manager, AWS Infrastructure Security

AWS Infrastructure Services owns the design, planning, delivery, and operation of all AWS global infrastructure. In other words, we"re the people who keep the cloud running. We support all AWS data centers and all of the servers, storage, networking, power, and cooling equipment that ensure our customers have continual access to the innovation they rely on. We work on the most challenging problems, with thousands of variables impacting the supply chain and we"re looking for talented people who want to help.

You"ll join a diverse team of software, hardware, and network engineers, supply chain specialists, security experts, operations managers, and other vital roles. You"ll collaborate with people across AWS to help us deliver the highest standards for safety and security while providing seemingly infinite capacity at the lowest possible cost for our customers. And you"ll experience an inclusive culture that welcomes bold ideas and empowers you to own them to completion.

The AWS Infrastructure Security Operations team is seeking a Security Engineering Manager to lead the detection and response mission protecting AWS"s operational network. Your team owns the full detection-to-response lifecycle-authoring the detection rules that surface threats, triaging and investigating security events, and driving incidents to resolution across AWS"s global infrastructure.

In this role, you will manage a team of security engineers responsible for network security telemetry, detection engineering, and incident response. Your team will leverage best-in-class technologies, including:

• AI-powered anomaly and threat detection
• Machine learning for signal enrichment and alert prioritization
• Detection-as-code pipelines (e.g. IDS/IPS and syslog-based rule engines)
• Network security telemetry and observability platforms
• Threat intelligence integration
• Forensic and root-cause analysis systems

You will drive the application of artificial intelligence and machine learning to transform how we detect, investigate, and respond to security threats at unprecedented scale. Through leadership of your team, partnerships within Infrastructure Security, and relentless customer obsession, you will raise the bar for threat detection and response-driving the vision for defending the largest and most complex network in the world.

AWS leads and innovates. We research and pursue the best approach for the business, whether that means building new solutions or leveraging existing ones. AWS-and Infrastructure Security in particular-operates at massive scale and demands the highest standards, passion, and discipline for information security. The highest level of ownership and accountability is essential for this role.

Key job responsibilities

• Lead and develop a team of security engineers focused on detection engineering, incident response, and security operations across AWS"s global infrastructure.
• Define and execute the strategic vision for detecting and responding to security threats across AWS"s operational network, from signal generation through incident resolution.
• Drive adoption of AI/ML-powered detection and response solutions, including anomaly detection, alert prioritization, and automated triage of security events.
• Own the end-to-end detection lifecycle, ensuring high-fidelity detection coverage, low false-positive rates, and consistent, measurable incident response outcomes.
• Partner cross-functionally with Infrastructure Security teams to close detection gaps, reduce mean-time-to-detect and mean-time-to-respond, and raise the security bar.
• Establish and track operational metrics to measure detection coverage, on-call health, incident response readiness, and overall team effectiveness.
• Recruit, mentor, and retain top security engineering talent while fostering a culture of ownership, innovation, and operational excellence.
• Communicate security posture, active threats, and strategic priorities to senior leadership with clarity and precision.

Champion continuous improvement through automation, tooling investments, and process optimization to stay ahead of evolving threats.