Security Engineer II, AWS Security Corporate Response

Amazon Inc.; Melbourne; On-site; AUD 120,000 - 180,000; Full time

Job summary

Amazon's AWS Corporate Security Response seeks a Security Engineer II who blends hands-on incident response with intelligent automation to detect, investigate, and disrupt threats across corporate infrastructure at scale.

You will independently lead security investigations from detection through containment and remediation, extract IOCs, perform forensics, and drive issues to resolution while shaping an autonomous investigation platform that scales beyond human capability.

Qualifications

• Bachelor's degree in computer science or equivalent, or IT security experience.
• Experience in security operations, incident response, or security engineering.
• Hands-on experience investigating security incidents (malware, phishing, credential compromise, or network intrusion).
• Proficiency in Python or similar scripting language for security automation and tooling.
• Experience with log analysis platforms (Splunk, ELK, or equivalent) and EDR tools (CrowdStrike, Carbon Black, or equivalent).
• Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux).

Responsibilities

• Lead Sev2 security investigations end-to-end: acknowledge, investigate with depth, document as you go, and own through resolution.
• Triage Sev2 candidates — promote decisively when indicators are clear, downgrade with documented rationale when they're not.
• Analyze open source threat intelligence — validate IOCs and block threats rapidly.
• Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor.
• Design and test guardrails and policies to prevent evasion and edge-case failures.
• Build tactical scripts, detection rules, and response automations for immediate gaps and scalable automation.
• Participate in a global on-call rotation: own the queue for your shift and maintain readiness.
• Execute clean shift handoffs: document active investigations and transfer ticket ownership.

Skills

Security investigations

Python scripting

Log analysis

Security operations

Education

Bachelor's degree in CS or IT security

Tools

Splunk

ELK

CrowdStrike

Carbon Black

Job description

Security Engineer II, AWS Security Corporate Response

AWS Corporate Security Response is looking for a Security Engineer who thrives at the intersection of hands-on incident response and intelligent automation. You must think like both an attacker and a defender — understanding adversary tradecraft to detect, investigate, and disrupt threats across Amazon's corporate infrastructure at massive scale.

You'll investigate active threats — malware campaigns, phishing attacks, credential compromise, and novel attack patterns — while simultaneously shaping an agentic investigation platform that scales our response capability beyond what any human team could achieve alone.

You will independently lead security investigations from detection through containment and remediation. You'll extract IOCs, perform host forensics, scope impact across multiple data sources, check for lateral movement, and drive security issues to resolution — documenting every step as the investigation unfolds. You'll also serve as a demanding customer and quality owner of our AI-powered investigation platform, authoring the investigation user stories that define how autonomous agents analyze threats, designing the guardrails that keep them safe, and validating that automated output meets the same standard a skilled human investigator would produce.

When you identify gaps in our capabilities, you won't wait — you'll quickly design and build tooling that enables programmatic automation at scale, then feed those patterns into the next generation of autonomous investigation.

Key job responsibilities

• Lead Sev2 security investigations end-to-end: acknowledge, investigate with depth (not speed), document as you go, and own through resolution
• Triage Sev2 candidates — promote decisively when indicators are clear, downgrade with documented rationale when they're not
• Analyze open source threat intelligence — these reports contain temporal IOCs that decay with age, making rapid validation and proactive blocking critical
• Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor
• Design and test guardrails and policies — think about how attackers would evade detection, how edge cases produce incorrect results, and how agents might fail in ways developers didn't anticipate
• Build tactical scripts, detection rules, and response automations that address immediate operational gaps — then drive their transition into scalable agentic capabilities
• Participate in a global on-call rotation: own the queue for your shift, monitor operational health, and maintain readiness
• Execute clean shift handoffs: document active investigations, flag anomalies observed during your shift, and explicitly transfer ticket ownership

About the team

CorpSec Response operates 24/7 as a global, follow-the-sun team protecting Amazon's corporate infrastructure. We combine deep human expertise with leading autonomous investigation capabilities. Our engineers are hands-on investigators who also shape the AI systems that augment their work — creating a unique feedback loop between human security expertise and machine-scale automation.

Inclusive Team Culture

We are committed to building a diverse and inclusive team. Amazon's culture of inclusion is reinforced within our Leadership Principles, which remind team members to seek diverse perspectives, learn and be curious, and earn trust.

Work-Life Balance

We value sustainable performance. Our follow-the-sun model means you're not carrying a pager 24/7 — your node owns its shift, and clean handoffs are a core operational discipline.

Growth and Impact

This role offers a rare combination: hands-on technical security work at massive scale, leadership of a high-performing team, and direct influence over an AI-augmented security platform. You'll grow as both a security practitioner and a technical leader.

Qualifications

• - Bachelor's degree in computer science or equivalent, or experience in IT Security
• - Experience in security operations, incident response, or security engineering
• - Hands-on experience investigating security incidents (malware analysis, phishing response, credential compromise, or network intrusion)
• - Proficiency in Python or similar scripting language for security automation and tooling
• - Experience with log analysis platforms (Splunk, ELK, or equivalent) and EDR tools (CrowdStrike, Carbon Black, or equivalent)
• - Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux)