Security Engineer II — AI-Driven Incident Response

Amazon Inc.; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Job summary

Amazon's AWS Corporate Security Response seeks a Security Engineer II who blends hands-on incident response with intelligent automation to detect, investigate, and disrupt threats across corporate infrastructure at scale.

You will independently lead security investigations from detection through containment and remediation, extract IOCs, perform forensics, and drive issues to resolution while shaping an autonomous investigation platform that scales beyond human capability.

Qualifications

• Bachelor's degree in computer science or equivalent, or IT security experience.
• Experience in security operations, incident response, or security engineering.
• Hands-on experience investigating security incidents (malware, phishing, credential compromise, or network intrusion).
• Proficiency in Python or similar scripting language for security automation and tooling.
• Experience with log analysis platforms (Splunk, ELK, or equivalent) and EDR tools (CrowdStrike, Carbon Black, or equivalent).
• Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux).

Responsibilities

• Lead Sev2 security investigations end-to-end: acknowledge, investigate with depth, document as you go, and own through resolution.
• Triage Sev2 candidates — promote decisively when indicators are clear, downgrade with documented rationale when they're not.
• Analyze open source threat intelligence — validate IOCs and block threats rapidly.
• Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor.
• Design and test guardrails and policies to prevent evasion and edge-case failures.
• Build tactical scripts, detection rules, and response automations for immediate gaps and scalable automation.
• Participate in a global on-call rotation: own the queue for your shift and maintain readiness.
• Execute clean shift handoffs: document active investigations and transfer ticket ownership.

Skills

Security investigations

Python scripting

Log analysis

Security operations

Education

Bachelor's degree in CS or IT security

Tools

Splunk

ELK

CrowdStrike

Carbon Black

Job description

Amazon's AWS Corporate Security Response seeks a Security Engineer II who blends hands-on incident response with intelligent automation to detect, investigate, and disrupt threats across corporate infrastructure at scale.

You will independently lead security investigations from detection through containment and remediation, extract IOCs, perform forensics, and drive issues to resolution while shaping an autonomous investigation platform that scales beyond human capability.