Senior Security Engineer, AWS Security Verification & Validation Team

Amazon Web Services (AWS); Greater London; On-site; GBP 120,000 - 180,000; Full time

Job summary

Amazon Web Services (AWS) is seeking a Senior Security Engineer to lead end-to-end security testing engagements within the Point-in-Time Security Testing team. You will apply human judgment to complex risk scenarios, build automations, and drive improvements across architectures and launches.

You will own testing strategy, run advanced penetration tests, and review code to identify vulnerabilities. You will mentor engineers, shape methodologies, and produce actionable results for stakeholders.

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field.
• 5+ years in professional penetration testing, source code auditing, bug hunting, or competitive CTF.
• Demonstrated ability to find non-trivial vulnerabilities through offensive testing of web apps and services and through source code review.
• Experience with complex security domains such as networking, isolation, web app security, IAM, or cryptography.
• Experience building and steering AI agents to perform security work and understanding attack on agentic systems.

Responsibilities

• Own security for a portfolio of testing engagements across the team and partner-orgs; set testing strategy across interconnected architectures and campaigns.
• Perform penetration testing and AI-augmented source code review of complex AWS software; direct tooling toward trust boundaries and attack paths.
• Translate risk hypotheses into documented conclusions; demonstrate issues with PoC code or rule out attack paths with evidence.
• Lead ambiguous engagements by clarifying scope, defining approaches, and re-scoping as needed to keep engagements on track.
• Trace attack paths across components; demonstrate compound risk crossing boundaries; keep results comprehensive and actionable.
• Produce clear engagement results, writing for non-engineering audiences; document tests, findings, limitations, and residual risk.
• Lead communication with developers and engineers; validate fixes; embed security testers in development lifecycles when launches require it.
• Build reusable frameworks, runbooks, and rubrics to enable repeatable testing and AI tooling improvements across the team.
• Leave behind reusable mechanisms like fuzzers, detection rules, and documented methodologies to drive future security outcomes.
• Set peer-review bar for the team; review plans, scopes, and reports; ensure extensibility and cost-effectiveness.

Skills

Security testing

Penetration testing

Source code review

Threat modeling

Risk analysis

Security architecture

Automation & AI security

Education

Bachelor's degree in Computer Science or related

Tools

CI/CD tooling

Security testing tools

Job description

Description

We are looking for a Senior Security Engineer to join Point-in-Time Security Testing, AWS's expert security assurance function for the launches and architectures where security automation alone is not enough. You will be a technical leader on a team, owning complex security testing engagements end-to-end, applying human judgment where it changes security outcomes and building automation for everything else.

Amazon Web Services (AWS) is the leading cloud service provider, providing virtualized infrastructure, storage, networking, messaging, and many other services to customers all over the world, including government customers. AWS runs a globally distributed environment operating at massive scale, and businesses from start-ups to large enterprises and governments run their most sensitive workloads on it. Point-in-Time Security Testing takes on the security engagements where the architecture, threat model, or potential impact is complex enough that expert reasoning matters most. We start from the architecture and the risks rather than a generic checklist, think like an adversary, and demonstrate realistic impact. We build harnesses that steer agentic AI so experts have more time for the difficult problems, and we turn what we learn into shared methods, mechanisms, and detections for the rest of the team. As AWS ships agentic systems of its own, those same systems become targets we test.

Our work is measured by how much difficult security uncertainty we resolve with the human time available to us, not by how many issues we find. In this role you will investigate high-consequence risks, which are specific, testable claims about how an adversary could cause harm, and take each one to a documented conclusion. You will either demonstrate the issue, rule out the attack path with enough evidence, or expose a weakness in a shared mechanism or detection.

You must produce results in the face of ambiguity and imperfect knowledge, foster constructive dialogue, and drive resolution when faced with disagreement. You work efficiently and routinely deliver the right things with limited guidance. You take a long-term view of the team's methods and tooling, proactively fix architectural and mechanism deficiencies, and propose larger project scopes that you can split into parallel work for yourself and others and reassemble successfully.

Amazon's Leadership Principles of "Dive Deep", "Earn Trust", "Deliver Results", and "Invent and Simplify" will be called upon daily. Above all, we earn trust by choosing carefully where humans spend time, testing those areas deeply, and being honest about what we know and what we do not.

Key job responsibilities

• Own security for a portfolio of testing engagements across your team and partner-orgs, as well as leading individual complex engagements. Set the testing strategy across interconnected microservice architectures, successive launch iterations, and cross-service campaigns, and decide where to spend expert effort across the whole service portfolio.
• Perform penetration testing and AI-augmented source code review of complex proprietary AWS software, directing the tooling at trust boundaries, abuse cases, and attack paths it would not reach on its own, confirming what it reports, and setting the methodology your team follows when they do the same.
• Take each agreed risk hypothesis to a documented conclusion, whether that means demonstrating the issue with proof-of-concept code, ruling out the attack path with sufficient evidence, or identifying a weakness in a shared mechanism or detection that affects services beyond the one under test.
• Take on engagements where the customer case is understood but no security strategy exists yet, bring clarity to the ambiguity, and define the approach others will reuse. Challenge what a scope document assumes and identify what it misses, then keep the engagement moving when conditions change by building alternative test paths, re-scoping, and parallelizing work with dependent teams.
• Trace attack paths across chained components and demonstrate compound risk that stays invisible when components are tested in isolation, including risk that crosses organizational and ownership boundaries.
• Produce clear engagement results that record what you tested, why you chose those tests, what you found or ruled out, the limitations of the work, and the risk that remains, and write for non-engineering audiences in your domain when the decision sits with them.
• Lead communication with developers, AppSec engineers, and other stakeholders when the scope is ambiguous or a fix is not straightforward, validate the fixes, work as an embedded security tester inside the development lifecycle when a launch calls for it, and lead escalations to closure with Senior Managers and Principal Engineers when a fix or a risk decision stalls.
• Build the frameworks, runbooks, and rubrics that let the whole team test a new problem domain repeatably, not only automation for a single harness. Tune the harnesses that raise the precision of the team's AI tooling, measure where they produce false positives or miss attack patterns, and generalize what works into a mechanism the team adopts.
• Leave reusable mechanisms behind, such as fuzzers, integration security tests, detection rules, tooling, or documented methodology, track their adoption, and where the work depends on teams with their own priorities, build the mechanisms that get security outcomes prioritized and tracked to delivery.
• Set the peer-review bar for the team. Review test plans, scopes, runbooks, and reports from peers and other teams, question coverage gaps, add the missing test cases, and ensure the work fits into the bigger picture and stays extensible and low-cost to adopt.
• Lead multi-engineer engagements and mentor multiple engineers across you own and related teams, are sought out for your expertise, and participate in promotion assessments.

About The Team

Why AWS Security?
At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon's products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience across cloud, devices, retail, entertainment, healthcare, operations, and physical stores.

Point-in-Time Security Testing sits within Proactive Security. While the wider organization builds the ability to find risk through signals, automation, AI, Bug Bounty, and continuous testing, our role is different. We take on the situations where expert reasoning matters most, and we make that expertise go further every year. Our vision is that every critical AWS launch receives the right depth of expert security testing, and every hour our team spends makes future testing more effective.

Diverse Experiences
Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed, we encourage you to apply. If your career is just starting, hasn't followed a traditional path, or includes alternative experiences, don't let it stop you from applying.

Inclusive Team Culture
In Amazon Security, it's in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to keep learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices.

Training & Career Growth
We're continuously raising our performance bar as we strive to become Earth's Best Employer. You'll find endless knowledge-sharing, mentorship, training, and other career-advancing resources here to help you develop into a better-rounded professional.

Work/Life Balance
We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture.

Basic Qualifications

• Experience developing software code in one or more programming languages (java, python, etc.)
• Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques
• Knowledge of security technology and concepts (Authentication, Authorization, Single sign-on, Cryptography, etc.)
• Experience in risk assessment and enabling organizations to make security decisions
• Experience working with operations and business teams to communicate problem impacts and understand business requirements
• Experience in enterprise software
• Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline
• 5+ years in professional penetration testing, source code auditing, bug hunting, or competitive CTF
• Demonstrated ability to find non-trivial vulnerabilities through offensive testing of web applications and services and through source code review
• Demonstrated mastery of two or more genuinely complex security domains such as networking, workload and tenant isolation, web application and API security, IAM, or cryptography, deep enough to find issues others miss and to encode that expertise into automation
• Experience building and steering AI agents to do useful security work, and reasoning about how those same agentic systems can be attacked

Preferred Qualifications

• Experience building agentic AI harnesses, orchestrating agents through graphs or swarms, and working with agent-to-agent (A2A) protocols and the security properties of tool use, memory, and model context
• Experience assessing the security of LLM-based or agentic applications, including prompt injection, tool and plugin abuse, and trust boundaries between agents
• Experience performing or supporting Red Team engagements, with an understanding of holistic assessment
• Web service assessment experience across authentication controls, session management, access controls, logic flaws, injection vulnerabilities, request smuggling, cloud privilege escalation, and tenant isolation
• Experience with serverless architectures and common virtualization techniques (hypervisors, containers, jails), including escapes and exploits within those environments
• Experience with micro-service, API-based, or service-oriented architectures
• Experience with full-stack Linux or Unix software architectures from UI to infrastructure
• Operations experience with CI/CD or managing distributed systems
• Experience designing and implementing technical security controls at the business-division level

Amazon is an equal opportunities employer. We believe passionately that employing a diverse workforce is central to our success. We make recruiting decisions based on your experience and skills. We value your passion to discover, invent, simplify and build. Protecting your privacy and the security of your data is a longstanding top priority for Amazon. Please consult our Privacy Notice (https://www.amazon.jobs/en/privacy_page) to know more about how we collect, use and transfer the personal data of our candidates.

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

Company

Amazon Development Centre (London) Limited

Job ID: A10552755