AWS Perimeter Security Software Development Engineer - Detection Amazon
Seattle, WA

Job Description

The AWS Perimeter Protection team protects customers of Amazon Web Services (AWS) and Amazon retail by providing tools to detect and filter malicious web requests. In 2016, we launched AWS Shield, a groundbreaking external service offering Advanced DDoS protection and mitigation to customers using AWS. In 2017, we extended this service to cover Elastic Compute, and supported the 2018 launch of AWS Global Accelerator. Moving forward, we are continuing to add new detection capabilities and a broader surface area.

What does the Lookout team do?

We monitor networks and applications to find anomalies that indicate DDoS or other application threats. We collect netflow from thousands of routers, as well as application logs and service logs from millions of internal services, and within minutes generate a set of metrics for reasoning about the traffic. We maintain baselines, and look for trends such as change of entropy, protocol, or other attributes. We then run detection algorithms that identify malicious traffic. When an attack is discovered, we notify users and services, and initiate many of the mitigations that protect AWS services and customers. We are the detection brains behind the AWS Shield Advanced, and protect customers using services such as EC2, S3, CloudFront, Route53, and others.

What challenges does Lookout tackle?

Lookout is a high availability service, responsible for collecting and analyzing data from dozens of distributed services. When networks or services are under duress, that is exactly when Lookout's services are most critical. We provide visibility to services such as CloudFront, Route53, S3, and EC2 networking, enabling those services to maintain high performance. We also provide detection and visibility into individual customer resources as part of AWS Shield Advanced. In order to present a timely view, we are running distributed aggregations every minute, running on thousands of servers in every AWS region or Edge Point of Presence. We also provide real-time updates to metrics, allowing internal operators to define new metrics that can be aggregated almost immediately. The biggest challenge Lookout faces is in collecting all of the disparate data and generating metrics in order to begin detection.

What is special about Lookout?

Quite simply, we are protecting both AWS customers and services by finding and blocking bad actors. We are a team of engineers responsible for building a highly-available, globally distributed anomaly detection system. Sales teams might group data by customer or region, we are building patters for a predicate known as "the internet". Lookout engineers are passionate about building a low-latency data stream that is then processed through detection services to identify malicious requests.

Why should you join us?

* We provide services that defend some of the Internet's largest businesses from bad actors and malicious requests.
* We care about both delighting customers and building high quality software. Our leadership principles (http://www.amazon.jobs/principles) empower managers to act and challenge us never to accept the status quo.
* We offer a fast-paced environment with a start-up atmosphere. We ship code every day.

To be successful in the role, you must be able to research, innovate and create unique solutions. There is no precedent to follow in this problem space. You will be involved from inception to deployment and beyond. You'll interact with our customers, gathering requirements, designing, implementing, testing and supporting the product operationally; soup to nuts. You will be expected to use your strong technical background and have a significant impact on the direction of the applications we develop.

Amazon is an Equal Opportunity-Affirmative Action Employer - Minority / Female / Disability / Veteran / Gender Identity / Sexual Orientation / Age