Title Senior Risk Analyst / Intelligence Analyst Location: Remote with 10-25% travel PST Duration: 12-14+ months Resource Location Preferences: Remote, ideally Pacific Time or Seattle based. Must be able to travel for workshops, pilots and stakeholder engagements; travel budget included. Hiring manager and team will be based out of Seattle.
Core availability overlapping Pacific Time business hours; multiple weekly sync with hiring manager, weekly working sessions with OS2 and technical development team, monthly leadership reporting.
Project Scope: SPEAR teams collect extensive data on security findings across the AWS fleet through Evaluations, Pre-Evaluations and the Special Testing Team (STT). Today this data is used in an ad hoc way for Governance, Risk and Compliance decisions through largely manual, labor-intensive processes. Without a standardized model, it is difficult to understand overall facility security health, report accurately on elevated risk caused by control deficiencies, or communicate enterprise risk posture to leadership consistently.
Project Achilles' Shield addresses this gap by delivering an automated platform for real time visualization, analysis and reporting of physical security risk across all AWS infrastructure. The model follows SPEAR's risk methodology, where Risk = Likelihood (Threat x Vulnerability) x Impact (Consequence and Recoverability). It enables data driven decision making, risk-based resource allocation and consistent application of security controls globally.
The end state is a single pane of glass view of physical security risk. Work streams in scope:
- Analytics and methodology: Analyze, validate and refine the analytics and scoring logic that feed the Achilles' Shield dashboard, including BRS scoring and weighting, Zone Health aggregation, adversary attack path calculations and threat and impact factors. Document assumptions, sensitivity testing and calibration results.
- Data collection and integration: Inventory existing data sources in the company, identify data gaps and define requirements for new features. The contractor identifies and writes requirements and acceptance criteria; our internal technical team owns all development.
- Documentation: Write user guides, FAQs, methodology papers, program one pagers and leadership briefing material, written for audiences from field teams to senior leaders.
- Program support: Manage timelines, deliverables, milestones, metrics and reporting for leadership. Maintain the project plan, RAID log (risks, assumptions, issues, dependencies) and status reporting cadence.
- Validation and launch: Support pilot testing with internal stakeholders, partner teams, and internal customers. Collect feedback and drive iteration before each phase launches.
- Out of scope: software development, dashboard engineering and data pipeline builds (owned by internal development teams), and onsite security evaluations.
Resource Requirements Resource Title: Senior Risk Analyst / Intelligence Analyst (Physical Security Risk Modeling)
Job Description: The contractor will serve as the dedicated analytic and program lead for Project Achilles' Shield, building data and metric driven risk products that inform senior Amazon Security leadership. They will apply structured, repeatable methodology to translate SPEAR security findings into scalable risk scoring, define requirements for the OS2 build team, develop documentation and program support products, and drive each phase from design through launch.
- Conduct analytical deep dives into SPEAR findings to identify vulnerabilities, systemic control weaknesses and root causes
- Refine and validate risk scoring methodology across BRS, Zone Health, Attack Path Analysis and Threat and Impact analysis
- Apply structured analytic techniques (for example: key assumptions check, critical path analysis, bias checks and assumption checks, EASI model and SAVI model) to test model logic and assumptions
- Translate analytic requirements into clear feature requirements and acceptance criteria for the OS2 development team
- Identify data gaps and recommend new data sources or collection methods
- Produce risk reports, briefing material and documentation for audiences from field teams to the most senior Amazon Security leadership
- Partner across functional lines with SPEAR, DC Security, InfraSecurity and threat intelligence teams to align on goals, objectives and outcomes
- Manage the program plan, milestones, metrics and leadership reporting; operate as a self-starter with limited oversight
Required Qualifications:- 5+ years as a risk analyst, intelligence analyst or (physical) security risk manager, with demonstrated hands-on experience producing analysis (not only consuming it)
- Demonstrated depth in at least two of: threat intelligence analysis, quantitative or semi quantitative risk modeling, physical security vulnerability assessment
- Experience applying structured analytic techniques, translating analysis into tools and dashboard
- Experience building, refining or defining requirements for risk tools, scoring models and dashboards
- Ability to analyze complex data sets and turn them into clear outputs for different audiences
- Proven program or project management experience delivering multi-phase initiatives on a fixed timeline
- Experience working horizontally and vertically across management structures and with partner organizations
Desired Qualifications:- Familiarity with adversary path analysis models such as EASI, SAVI, or vulnerability assessment methodologies used in critical infrastructure (power grid, utilities, government facilities, telecom facilities)
- Experience with data center or critical infrastructure security programs
- Experience with continuous improvement cycles and analytical methodology
- Ability to communicate effectively with both technical and non-technical audiences