Sr. Security Engineer, Stores Application Security

Amazon; Bengaluru; On-site; INR 2,500,000 - 5,000,000; Full time

Job summary

Amazon is seeking an AppSec engineer to partner with software teams across the organization to keep customers safe while delivering cutting-edge services. You may inspect code for security issues, design a new security framework, or fine-tune service designs with developers.

The ideal candidate blends deep security expertise with strong influence and communication skills, capable of prioritizing risk and guiding partners toward secure solutions in a fast-moving environment.

Qualifications

• 5+ years identifying security issues and developing mitigations.
• Experience leading an engineering team or as mentor/tech lead.
• BS in Computer Science or related field.
• Strong application security background with scalable solutions.
• Knowledge of threat modeling, design reviews, code review, vulnerabilities, remediation.
• Strong AWS cloud and network architecture knowledge.
• Programming/scripting in Java, Python, Perl, Bash, Ruby, PowerShell, or similar.
• Excellent written and verbal communication.
• Ability to work in ambiguous environments and remove bottlenecks.

Responsibilities

• Create, update, and maintain threat models for a wide variety of software projects.
• Security architecture and design guidance.
• Manual and automated secure code review primarily in Java, Python, and JavaScript.
• Development of security automation tools.
• First-party application security research.
• Adversarial security analysis using innovative tools to augment manual effort.
• Security training and outreach for internal development teams.
• Independently solving security problems that require novel methods or approaches.
• Influencing team and partner priorities to improve outcomes.

Skills

Threat modeling

Security architecture

Code review

Mitigation planning

AWS cloud

Programming: Java

Programming: Python

Communication

Ambiguity handling

Education

BS in Computer Science or related field

Job description

Description

In Amazon Stores, we ship some of the widest arrays of technology found at any company. From amazon.com to world class machine learning pipelines, from innovative digital healthcare to no-checkout retail, we push the boundaries of technology in every direction using the globe’s largest AWS deployment.

As an AppSec engineer, you will collaborate with software development teams to ensure we keep our customers safe while developing these novel services. In a given day, you might be inspecting an application’s code for security issues, building a new framework to help our software developers build faster and more securely, or fine‑tuning the design for a new service alongside its software developers.

The ideal candidate combines technical acumen with an ability to lead by influence and communicate clearly. Technically, this person will be a security generalist with one or more areas of deep expertise. In their communication, they will clearly articulate risks to technical and non‑technical audiences alike. Interpersonally, successful candidates will effectively harmonize disparate opinions while effectively prioritizing risks to guide their partners towards secure solutions.

Key Responsibilities

• Creating, updating, and maintaining threat models for a wide variety of software projects
• Security architecture and design guidance
• Manual and automated secure code review primarily in Java, Python, and JavaScript
• Development of security automation tools
• First-party application security research
• Adversarial security analysis using innovative tools to augment manual effort
• Security training and outreach for internal development teams
• Independently solving security problems that require novel methods or approaches
• Influencing team and partner priorities, processes, and choices to improve outcomes

Basic Qualifications

• 5+ years of experience identifying security issues and risks, and developing mitigation plans
• Experience leading an engineering team or acting as a mentor or tech lead
• BS in Computer Science or related field
• Strong application security background focusing on scalable solutions
• Solid understanding of threat modeling, design and architecture review, manual source code review, security vulnerabilities, attacker exploit techniques, and remediation methods
• Strong network and cloud (AWS) architecture knowledge
• Programming and scripting skills in Java, Python, Perl, Bash, Ruby, PowerShell, or similar
• Excellent written and verbal communication skills
• Ability to work in ambiguous and evolving environments and remove bottlenecks for teammates

Preferred Qualifications

• Experience applying threat modeling or equivalent risk identification techniques
• Experience with security in service-oriented architectures or microservices
• Strong judgment in assessing and prioritizing technical risk
• Experience designing, building, and securing complex AWS architectures
• Knowledge of identity and access management, authentication, software development, cryptography, or security research
• Hands-on experience performing security activities across SDLC phases, including design reviews, threat modeling, code reviews, and testing
• Ability to drive scalable improvements in security controls and collaborate with stakeholders on security strategy

Work-Life Balance

We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture.

Inclusion & Diversity

Amazon Security values diverse experiences and encourages candidates who do not meet all listed qualifications to apply. We commit to a culture of learning, curiosity, and celebrating diverse ideas.

Accommodation Statement

If you have a disability and need workplace accommodations or adjustments during the application and hiring process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.