Incident Response Engineer — AI-Driven Security Automation

Amazon Web Services (AWS); Melbourne; On-site; AUD 150,000 - 230,000; Full time

Job summary

Amazon Corporate Services Pty Ltd in Melbourne is seeking a Security Engineer who thrives at the intersection of hands-on incident response and intelligent automation. You will investigate active threats across Amazon's corporate infrastructure at massive scale and shape an agentic investigation platform.

You will lead investigations end-to-end, extract IOCs, perform host forensics, and document findings. You will also author user stories and help design guardrails for autonomous agents,

Qualifications

• Bachelor's degree in computer science or equivalent, or IT security experience.
• Hands-on experience in security operations, incident response, or security engineering.
• Proficient in Python or similar scripting language for security automation and tooling.
• Experience investigating security incidents (malware, phishing, credential compromise, or network intrusion).
• Knowledge of log analysis platforms (Splunk, ELK) and EDR tools.
• Understanding networking protocols and Windows/Linux internals.

Responsibilities

• Lead High Severity security investigations end-to-end: acknowledge, investigate with depth (not speed), document as you go, and own through resolution
• Triage High Severity candidates — promote decisively when indicators are clear, downgrade with documented rationale when they’re not
• Analyze open source threat intelligence — these reports contain temporal IOCs that decay with age, making rapid validation and proactive blocking critical
• Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor
• Design and test guardrails and policies — think about how attackers would evade detection, how edge cases produce incorrect results, and how agents might fail in ways developers didn’t anticipate
• Build tactical scripts, detection rules, and response automations that address immediate operational gaps — then drive their transition into scalable agentic capabilities
• Participate in a global on‑call rotation: own the queue for your shift, monitor operational health, and maintain readiness
• Execute clean shift handoffs: document active investigations, flag anomalies observed during your shift, and explicitly transfer ticket ownership

Skills

Security operations

Incident investigation

Python scripting

Threat detection

Education

Bachelor's degree in computer science or equivalent

Tools

Splunk

ELK Stack

EDR tools

Job description

Amazon Corporate Services Pty Ltd in Melbourne is seeking a Security Engineer who thrives at the intersection of hands-on incident response and intelligent automation. You will investigate active threats across Amazon's corporate infrastructure at massive scale and shape an agentic investigation platform.

You will lead investigations end-to-end, extract IOCs, perform host forensics, and document findings. You will also author user stories and help design guardrails for autonomous agents,