Senior Security Risk Specialist, Global Benefits Risk & Compliance

The Benefits Experience and Technology Risk team (BXT Risk) is responsible for managing employee benefits risk activities in countries where we do business. As a Senior Security Risk Specialist on the BXT Risk team, you will serve as a subject matter expert and strategic contributor to our benefits third-party risk ecosystem, working across the organization with US benefits policy, process, and system owners to define strategies, evaluate complex risks, and drive scalable solutions that mitigate risks introduced by third-party vendors and service providers supporting the organization's US health and financial employee benefit programs.

This role requires both tactical execution and strategic thinking. You will independently lead complex third-party risk assessments, influence vendor security and compliance strategies across the organization, shape how the team scales its risk management capabilities, and drive alignment across diverse stakeholders with potentially conflicting priorities. You will create predictable process paths and repeatable mechanisms that multiple teams utilize, mentor junior team members, and advise managers and directors on third-party risk matters affecting employee benefits programs.

Key job responsibilities Third-Party Risk Strategy and Assessment: - Lead complex third-party vendor risk assessments across multiple benefits programs and vendor relationships, evaluating security, privacy, and compliance posture against federal, state, and local regulatory requirements - Define and iterate on risk assessment methodologies, frameworks, and mechanisms to scale for diverse vendor requirements and evolving regulatory expectations (e.g., quantitative risk models, vendor risk questionnaires, continuous monitoring approaches) - Identify long-term risks associated with third-party vendors and influence business strategy to proactively mitigate them before they materialize into risk events - Make diligent, independent decisions on how to engage vendors, auditors, and regulators on third-party risk matters with minimal oversight - Drive comprehensive benefits compliance management related to third-party service delivery, ensuring adherence to federal, state, and local regulatory requirements including HIPAA, ERISA, ACA, and COBRA - Lead risk and control assessments of vendor-managed processes, determine state of compliance, analyze risk exposure, and author reports detailing methodology, results, and remediation plans

Program Leadership and Scalable Solutions: - Own and drive third-party risk review programs associated with benefits program launches, modifications, vendor onboarding, and transitions across the organization - Create predictable process paths, workflows, and repeatable mechanisms (e.g., for vendor security control design, testing, implementation, and validation) that multiple teams utilize to deliver consistent risk management outcomes - Identify opportunities to simplify approaches throughout the organization and across project boundaries; decouple dependencies and prevent duplicate or wasted effort - Define business problems, set objectives, analyze data, drive improvements, and influence resource allocation for third-party risk initiatives - Develop mechanisms to inspect, monitor, and improve third-party risk delivery over time; hold the team to a high standard for both solutions and practices - Escalate when risks or blockers emerge, propose viable recommendations to resolve them, identify the correct owners, and track issues to resolution

Vendor Systems, Process, and Compliance Oversight: - Develop deep understanding of the employee benefits solutions utilized by Amazon and the third-party vendors that support them; drive business requirements for vendor system implementations and enhancements - Lead collaboration with vendors and external teams to evaluate security controls, negotiate remediation timelines, and ensure employee-centered benefits experiences are delivered securely - Understand the builder and stakeholder experience with security compliance and proactively seek to align third-party risk processes with existing workflows - Author written narratives to define strategy, evaluate trade-offs, anticipate risks, and recommend solutions on third-party risk that influence the organization and external partners

Stakeholder Engagement, Influence, and Communication: - Drive business and technical discussions across the organization to make decisions on how to align with diverse, potentially conflicting, third-party risk and compliance expectations - Advise managers and directors on third-party risk matters; communicate effectively with leaders up to three levels above on risk posture, compliance gaps, and strategic recommendations - Write, speak, and network with key internal and external stakeholders to broaden influence on third-party risk management practices - Develop and deliver documentation such as manager and employee communications, FAQs, policy positions, standard operating procedures, and strategic narratives related to third-party risk - Mentor and develop junior team members in third-party risk assessment methodologies, compliance frameworks, and stakeholder engagement

About the team The BXT Risk team is made up of lawyers, risk specialists, data security specialists, automation experts, and privacy specialists with global HR and benefits backgrounds. We are a dedicated collective committed to creating supportive, comprehensive benefits solutions. We provide our benefits stakeholders guidance to help them identify and manage potential risks and improve their team's risk management strategies and compliance posture. The team proactively scans the horizon for new and emerging risks not yet fully developed or understood, and performs inspections to identify compliance gaps and control weaknesses before they materialize into risk events. We provide end-to-end risk management oversight, including risk identification, risk assessments, risk quantification, compliance advisory services, inspection services, control design and testing, compliance solutions, risk monitoring and reporting, issue management, and risk training. We cultivate an environment where every team member feels valued, empowered, and equipped to thrive both professionally and personally. Our work goes beyond benefits operations - we're building experiences that genuinely care for our employees. - Bachelor's degree or equivalent in Information Security, Computer Science, Risk Management, Engineering, Math, Statistics, or a related discipline, or equivalent technology experience - 7+ years of risk management, audit, legal, compliance or related field work including engaging with external stakeholders experience - Experience with IT compliance and risk management requirements (e.g. security, privacy, SOX, HIPAA etc.) - CISSP, CISA, CISM or other security certification - Advanced degree in a related area (Information Security, Risk Management, MSHR, MBA, JD) - Deep knowledge of federal benefits regulations including ACA, COBRA, ERISA, and HIPAA, as well as state and local regulations including Massachusetts, Vermont, Hawaii, and San Francisco - Experience influencing vendor security and compliance strategies across an organization, including negotiating remediation timelines and shaping vendor contractual obligations - Proficiency across multiple widely adopted security compliance regimes and frameworks (SOC, PCI, NIST, ISO) with ability to apply expertise across diverse regulatory environments

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit <a href="https: