Information Systems Security Engineer (ISSE)

Amazon Leo is a constellation of Low Earth Orbit satellites that will provide low-latency, high-speed broadband network connectivity to unserved and underserved communities around the world.

We are seeking a Senior Information Systems Security Engineer (ISSE) to raise the security bar for a portfolio of classified national security systems. You will work backward from mission and authorization outcomes, translate complex security requirements into practical engineering decisions, and own security across the full system lifecycle - from concept and architecture through assessment, authorization, operations, change, and decommissioning.

This is a senior individual-contributor role for an engineer who can operate independently in ambiguous environments, dive into technical details, and influence system owners, architects, developers, operations teams, ISSMs/ISSOs, assessors, and authorizing officials. You will balance immediate mission needs with durable security controls, automate recurring work, and communicate risk clearly to technical and senior leadership audiences.

The successful candidate has both breadth and depth: hands-on knowledge of operating systems, networks, cloud and virtualization, identity, logging, vulnerability management, cryptography, and secure architecture, combined with demonstrated mastery of the Risk Management Framework (RMF) for classified systems. A top secret clearance with SCI access is required.

Key job responsibilities

• Own end-to-end security engineering for multiple concurrent classified systems and enclaves, establishing priorities, schedules, risks, dependencies, and decision pathds with minimal direction.
• Lead system security architecture and design reviews; define security requirements, trust boundaries, control allocation, data flows, threat models, and defense-in-depth strategies for on-premises, cloud, hybrid, and disconnected environments.
• Drive RMF activities through authorization and continuous monitoring, including categorization, control tailoring, implementation guidance, assessment readiness, risk acceptance packages, significant-change analysis, and authorization maintenance.
• Develop and maintain high-quality authorization evidence, including system security plans, control implementation statements, security control traceability matrices, architecture diagrams, hardware/software inventories, test plans, assessment artifacts, risk assessments, plans of action and milestones, and continuous-monitoring records.
• Partner with system owners, ISSMs, ISSOs, architects, administrators, developers, security control assessors, authorizing officials, customers, and facility/industrial-security teams to resolve findings and make well-reasoned risk decisions.
• Engineer and validate secure configurations using applicable government security standards and baselines.
• Lead technical investigations of vulnerabilities, incidents, control failures, and anomalous results for the applicable environments; determine root cause, assess mission impact, define containment and remediation, and create mechanisms that prevent recurrence.
• Build automation, reusable templates, dashboards, and quality checks that reduce manual effort, shorten authorization cycle time, improve evidence consistency, and provide leadership with actionable measures of residual risk.
• Make and document security trade-offs that distinguish non-negotiable risk from reversible decisions; escalate clearly when mission, schedule, and security objectives conflict.
• Mentor engineers and security practitioners, conduct peer reviews, raise documentation and engineering standards, and serve as a trusted technical resource across programs.

A day in the life

You may begin by documenting a proposed architecture change for a classified enclave, then lead a working session to close assessment findings, validate a control implementation against technical evidence, and brief leadership on the risk of a schedule decision. Later, you might automate an evidence-quality check, review vulnerability trends across the portfolio, coach an engineer through a difficult control interpretation, or coordinate with an assessor before an authorization milestone. You move comfortably between technical depth, program judgment, and concise executive communication.

About the team

Leo Security protects the people, facilities, hardware, supply chain, and classified communications behind a global satellite constellation. The ISSE function within this team owns the security architecture, administration and compliance of all Leo classified networks. The team works directly with engineering, program security, and government customers to architect and maintain secure sensitive networks across ALG sites.