Amazon
Sr Security Engineer, Supply Chain, Leo Security
$178K–$227K
Arlington, VA +1 · Senior · Full-time · Posted Aug 27, 2026
- Location
- Arlington, VA
Herndon, VA - Experience
- 5+ years in each of the two stated experience areas; the posting does not state alternatives.
About the job
Conduct security assessments and threat modeling for Leo suppliers and manufacturers, and develop AI-assisted tools to improve the supply chain security program.
What you'll do
- Lead onsite cybersecurity and physical security assessments of supplier and contract manufacturer facilities; document risks, severity, and remediation guidance.
- Threat-model supply chain, manufacturing, and OT/ICS environments, and refine assessment methods and program processes.
- Build AI-assisted tools for evidence collection, finding triage, and report generation; coordinate security mitigations and requirements with partner teams.
What they ask for
- 5+ years identifying security issues and risks and developing mitigation plans.
- 5+ years of non-internship experience in security engineering, security assessments, or security operations.
- Experience conducting security assessments or audits, including evaluating cybersecurity and physical security controls.
- Knowledge of security frameworks and standards such as NIST 800-53, NIST 800-161, ISO 27001, or NIST 800-171; ability to document and communicate findings and risk ratings.
Nice to have
- Experience in supply chain risk management, third-party risk assessment, or vendor security evaluation.
- Experience assessing physical security or cybersecurity at manufacturing, industrial, hardware, or OT facilities.
Pay
178,400.00 - 226,700.00 USD annually (base salary); 178,400.00 - 226,700.00 USD annually (base salary)
Tools
OT/ICS, NIST 800-53, NIST 800-161, ISO 27001, NIST 800-171, NISTIR 8276, FAR/DFARS, CMMC
AI focus
Develop AI-assisted tooling to automate evidence collection, finding triage, and report generation; threat-model AI-integrated topologies.
Model-written summary · the original posting is authoritative