Security Engineer, AWS Security

The AppSec Security Engineer evaluates service design and architecture and performs deep-dive security assessments to ensure applications and services meet a high security bar before launch. This role works alongside senior engineers to identify issues, drive remediation, and validate that security requirements are met.

Key job responsibilities

• Security Reviews: Conduct design reviews for new and existing services, evaluating architecture documents and system designs for security risks.
• Threat Modelling: Identify attack vectors and security weaknesses in application architectures through structured threat-modelling exercises.
• Penetration Testing: Coordinate penetration testing to validate security controls and identify exploitable vulnerabilities.
• Finding Management: Document, track, and communicate security findings to service teams with clear remediation guidance, and verify fixes are implemented.
• Security Guidance: Advise development teams on secure coding practices, authentication/authorization mechanisms, cryptographic implementations, and data protection strategies.
• Escalation Support: Identify and elevate high-severity issues through appropriate channels, ensuring timely remediation aligned with launch timelines.
• Documentation: Maintain clear documentation of review outcomes, security decisions, and risk assessments.
• Tool Improvements: Leverage automated tools to support reviews and improve efficiency.

Basic Qualifications

• Experience with web protocols, common security attacks, and remediation (non-internship).
• Bachelor’s degree or above in Computer Science, Engineering, or related fields.
• Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent.
• Experience in application security architecture, security code reviews, security testing, incident response, or security infrastructure.
• Experience with coding/scripting in one or more languages (e.g., Python, C, C++, Java, Ruby, or PowerShell).

Preferred Qualifications

• Experience with AWS services or other cloud offerings.
• Experience in one or more of the following: application security frameworks, security code reviews, incident response, security infrastructure, penetration testing, mobile security, cloud security, AI security, identity and access controls.
• Knowledge of one or more of the following domains: web application development, penetration testing, mobile security, cryptography, public key infrastructure, forensic security, IP security, SSL/TLS, computer viruses and malware, network security, trusted security, trusted execution, threat intelligence, IoT security implications, or authentication.
• Experience scripting with Python, Perl, Bash or PowerShell.
• Experience triaging and developing security alerts and response automation, conducting front-line analysis, and providing escalation support.

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

• Experience with web protocols, common security attacks, and remediation (non-internship).
• Bachelor’s degree or above in Computer Science, Engineering, or related fields.
• Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent.
• Experience in application security architecture, security code reviews, security testing, incident response, or security infrastructure.
• Experience with coding/scripting in one or more languages (e.g., Python, C, C++, Java, Ruby, or PowerShell)., * Experience with AWS services or other cloud offerings.
• Experience in one or more of the following: application security frameworks, security code reviews, incident response, security infrastructure, penetration testing, mobile security, cloud security, AI security, identity and access controls.
• Knowledge of one or more of the following domains: web application development, penetration testing, mobile security, cryptography, public key infrastructure, forensic security, IP security, SSL/TLS, computer viruses and malware, network security, trusted security, trusted execution, threat intelligence, IoT security implications, or authentication.
• Experience scripting with Python, Perl, Bash or PowerShell.
• Experience triaging and developing security alerts and response automation, conducting front-line analysis, and providing escalation support.