AI-Powered Security Incident Response Engineer

Amazon Inc.; Melbourne; On-site; AUD 150,000 - 190,000; Full time

Job summary

Amazon is seeking a Security Incident Response Engineer for AWS Security Corporate Response in Melbourne. The role blends hands-on incident response with intelligent automation to detect, investigate, and disrupt threats across Amazon's corporate infrastructure at scale.

You will lead investigations end-to-end, analyze threats, author agent user stories for autonomous investigations, and design guardrails for safe AI‑augmented security workflows.

Qualifications

• Bachelor's degree in computer science or equivalent, or IT security experience.
• Experience in security operations, incident response, or security engineering.
• Hands-on experience investigating security incidents (malware analysis, phishing response, credential compromise, or network intrusion).
• Proficiency in Python or a similar scripting language for security automation and tooling.
• Experience with log analysis platforms (Splunk, ELK, or equivalents) and EDR tools (CrowdStrike, Carbon Black, or equivalents).
• Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux).

Responsibilities

• Lead High Severity security investigations end-to-end: acknowledge, investigate with depth (not speed), document as you go, and own through resolution
• Triage High Severity candidates — promote decisively when indicators are clear, downgrade with documented rationale when they’re not
• Analyze open source threat intelligence — these reports contain temporal IOCs that decay with age, making rapid validation and proactive blocking critical
• Author and validate agent investigation user stories, ensuring autonomous investigations match human‑quality rigor
• Design and test guardrails and policies — think about how attackers would evade detection, how edge cases produce incorrect results, and how agents might fail in ways developers didn’t anticipate
• Build tactical scripts, detection rules, and response automations that address immediate operational gaps — then drive their transition into scalable agentic capabilities
• Participate in a global on‑call rotation: own the queue for your shift, monitor operational health, and maintain readiness
• Execute clean shift handoffs: document active investigations, flag anomalies observed during your shift, and explicitly transfer ticket ownership

Skills

Incident response

Security engineering

Python scripting

Log analysis

Networking knowledge

Education

Bachelor's degree in computer science or equivalent

Tools

Splunk/ELK

CrowdStrike

Carbon Black

Job description

Amazon is seeking a Security Incident Response Engineer for AWS Security Corporate Response in Melbourne. The role blends hands-on incident response with intelligent automation to detect, investigate, and disrupt threats across Amazon's corporate infrastructure at scale.

You will lead investigations end-to-end, analyze threats, author agent user stories for autonomous investigations, and design guardrails for safe AI‑augmented security workflows.