[Hiring] Senior Security Engineer @Amazon

Role Description

We are looking for a Senior Security Engineer to join Point-in-Time Security Testing, AWS's expert security assurance function for the launches and architectures where security automation alone is not enough. You will be a technical leader on a team, owning complex security testing engagements end-to-end, applying human judgment where it changes security outcomes and building automation for everything else.

Our work is measured by how much difficult security uncertainty we resolve with the human time available to us, not by how many issues we find. In this role you will investigate high-consequence risks, which are specific, testable claims about how an adversary could cause harm, and take each one to a documented conclusion.

• Own security for a portfolio of testing engagements across your team and partner-orgs, as well as leading individual complex engagements.
• Set the testing strategy across interconnected microservice architectures, successive launch iterations, and cross-service campaigns.
• Perform penetration testing and AI-augmented source code review of complex proprietary AWS software.
• Take each agreed risk hypothesis to a documented conclusion.
• Take on engagements where the customer case is understood but no security strategy exists yet.
• Trace attack paths across chained components and demonstrate compound risk.
• Produce clear engagement results that record what you tested, why you chose those tests, what you found or ruled out, the limitations of the work, and the risk that remains.
• Lead communication with developers, AppSec engineers, and other stakeholders.
• Build the frameworks, runbooks, and rubrics that let the whole team test a new problem domain repeatably.
• Leave reusable mechanisms behind, such as fuzzers, integration security tests, detection rules, tooling, or documented methodology.
• Set the peer-review bar for the team.
• Lead multi-engineer engagements and mentor multiple engineers across your own and related teams.

Qualifications

• Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language.
• Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools.
• Experience working in identifying security issues and risks, and developing mitigation plans.
• Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques.
• Experience as a mentor, tech lead or leading an engineering team.
• Experience developing software code in one or more programming languages (java, python, etc.).
• Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques.
• Knowledge of security technology and concepts (Authentication, Authorization, Single sign-on, Cryptography, etc.).
• Experience in risk assessment and enabling organizations to make security decisions.
• Experience working with operations and business teams to communicate problem impacts and understand business requirements.
• Experience in enterprise software.
• Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline.
• Extensive Professional Experience penetration testing, source code auditing, bug hunting, or competitive CTF.
• Demonstrated ability to find non-trivial vulnerabilities through offensive testing of web applications and services and through source code review.
• Demonstrated mastery of two or more genuinely complex security domains such as networking, workload and tenant isolation, web application and API security, IAM, or cryptography.
• Experience building and steering AI agents to do useful security work.

Requirements

• Experience applying threat modeling or other risk identification techniques or equivalent.
• Experience with security in service-oriented architectures/microservices and web services.
• Experience building agentic AI harnesses, orchestrating agents through graphs or swarms.
• Experience assessing the security of LLM-based or agentic applications.
• Experience performing or supporting Red Team engagements.
• Web service assessment experience across authentication controls, session management, access controls, logic flaws, injection vulnerabilities, request smuggling, cloud privilege escalation, and tenant isolation.
• Experience with serverless architectures and common virtualization techniques.
• Experience with micro-service, API-based, or service-oriented architectures.
• Experience with full-stack Linux or Unix software architectures from UI to infrastructure.
• Operations experience with CI/CD or managing distributed systems.
• Experience designing and implementing technical security controls at the business-division level.

Benefits

• Continuous knowledge-sharing, mentorship, training, and other career-advancing resources.
• Work-life harmony with flexibility as part of our working culture.