Lead End-to-End Security Testing & Validation Engineer

Amazon Inc.; Lombardia; Hybrid; EUR 120,000 - 170,000; Full time

Job summary

Amazon Web Services (AWS) is seeking a Security Engineer to join the Point-in-Time Security Testing team. You will own complex security testing engagements end-to-end, build harnesses that steer agentic AI for advanced testing, and drive improvements across architectures where security automation alone is not enough.

You will mentor engineers, collaborate with AppSec engineers and Blue teams, and help define rigorous test methodologies for adversarial scenarios.

Qualifications

• Experience acting as the testing point of contact for a service or technology area across more than one engagement.
• Experience running an initiative such as a CTF or an apprenticeship.
• Experience performing or supporting Red Team engagements with an understanding of holistic assessment.
• Experience with full-stack (Linux / Unix) software architectures from UI to infrastructure.
• Experience with serverless architectures and common virtualization techniques (hypervisors / containers / jails) and escapes and exploits within those environments.
• Experience with micro-service, API-based, or service-oriented software architectures.
• Operations experience with CI/CD or managing distributed systems.
• Web service assessment experience with authentication controls, session management, access controls, logic flaws, injection vulnerabilities, request smuggling, cloud privilege escalation, and tenant isolation

Responsibilities

• Lead complex security testing engagements end to end, including multi-engineer tests across interconnected microservice architectures, repeat testing across successive iterations of one launch, and campaigns that investigate a systemic issue across several services
• Perform penetration testing and AI-augmented source code review of complex proprietary AWS software, directing the tooling at trust boundaries, abuse cases, and attack paths it would not reach on its own, and confirming what it reports
• Take each agreed risk hypothesis to a documented conclusion, whether that means demonstrating the issue with proof-of-concept code, ruling out the attack path with sufficient evidence, or identifying a weakness in a shared mechanism or detection
• Challenge what a scope document assumes and identify what it misses, then keep the engagement moving when conditions change by building alternative test paths, re-scoping, and parallelizing work with dependent teams
• Trace attack paths across chained components and demonstrate compound risk that stays invisible when components are tested in isolation
• Assess and defend the business impact of complex and ambiguous risk, not only well-understood vulnerability classes, so service teams can act on the right things first
• Produce clear engagement results that record what you tested, why you chose those tests, what you found or ruled out, the limitations of the work, and the risk that remains
• Lead communication with developers, AppSec engineers, and Blue teams when the scope is ambiguous or a fix is not straightforward, validate the fixes, confirm remediation through Verification of Fixes, and work as an embedded security tester inside the development lifecycle when a launch calls for it
• Build automation and tune the harnesses that raise the precision of the team's AI pentest bots, measuring where they produce false positives or miss attack patterns, so expert time goes where it changes the outcome
• Test agentic AI systems as an adversary would, reasoning about how agent-to-agent (A2A) communication, tool use, memory, and orchestration can be manipulated or made to cross a trust boundary
• Leave reusable mechanisms behind, such as fuzzers, integration security tests, detection rules, tooling, or documented methodology, and track whether they are adopted
• Peer review test plans, scopes, runbooks, and reports from other peers, questioning coverage gaps and adding the test cases that are missing
• Onboard and mentor engineers on your engagements, helping them grow technically while the engagement stays on track

Skills

Full-stack Linux/Unix

Red Team experience

Cloud security testing

Job description

Amazon Web Services (AWS) is seeking a Security Engineer to join the Point-in-Time Security Testing team. You will own complex security testing engagements end-to-end, build harnesses that steer agentic AI for advanced testing, and drive improvements across architectures where security automation alone is not enough.

You will mentor engineers, collaborate with AppSec engineers and Blue teams, and help define rigorous test methodologies for adversarial scenarios.