Threat-Informed Penetration Test Engineer, CST

Amazon; Scotland; On-site; GBP 90,000 - 130,000; Full time

Job summary

Amazon Development Centre (London) Limited is seeking a Security Engineer to join Continuous Security Testing, testing live AWS services and internal systems with penetration testing augmented by AI tools. You will translate real-world signals into hypotheses, drive freedom-to-operate testing across production, and mentor junior engineers while delivering reproducible proof-of-concept results.

You’ll work on inventive security research, collaborate with SecOps and AppSec, and help build lasting

Qualifications

• Experience applying threat modeling or other risk identification techniques.
• Perform offensive testing of web applications and services, and source code review, to identify non-trivial issues.
• Script your way out of problems and deploy code in an enterprise environment.
• Experience with AWS technologies and services (e.g. S3, Lambda, EC2, KMS, IAM).
• Be data-driven and support your conclusions with evidence.
• A Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent professional experience.
• Experience in professional penetration testing, source code auditing, bug hunting, or CTF experience.
• Demonstrable depth in at least two complex security domains such as identity and access management, web app security, networking, or workload isolation.
• Experience finding security issues in multiple languages, including Java, Python, JavaScript, Rust, Ruby and C.
• Experience in code development using Python or an equivalent language, including boto3.

Responsibilities

• Turn threats and signals into testable hypotheses about adversary thinking in production systems.
• Test live AWS services and internal systems with penetration testing and AI-assisted code review.
• Invent new techniques and research areas to advance security testing.
• Prove or rule out impact end-to-end with safe, reproducible proofs-of-concept.
• Trace attack paths across components to show compound risk beyond isolated tests.
• Drive findings to resolution with service teams and SecOps to validate fixes.
• Turn findings into lasting defenses like detections and canaries across the fleet.
• Build and tune AI testing harnesses to detect miss patterns and reduce false positives.
• Test agentic AI systems as adversaries, including tool use and memory behavior.
• Write clear results documenting tests, findings, and remaining risk.
• Peer review scopes and mentor engineers on the team.

Skills

Threat modeling

Offensive testing

Scripting

AWS technologies

Data-driven

Penetration testing

Security domains

Programming languages

Education

Bachelor's degree in CS or related field

Tools

Python

boto3

Job description

Amazon Development Centre (London) Limited is seeking a Security Engineer to join Continuous Security Testing, testing live AWS services and internal systems with penetration testing augmented by AI tools. You will translate real-world signals into hypotheses, drive freedom-to-operate testing across production, and mentor junior engineers while delivering reproducible proof-of-concept results.

You’ll work on inventive security research, collaborate with SecOps and AppSec, and help build lasting