Security Engineer, Forward Deployed Engineering, Forward Deployed Engineering

Amazon Web Services (AWS); Mountain View (CA); On-site; USD 167,000 - 213,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

Paid time off

Parental leave

Employee assistance program

Job summary

Amazon Web Services (AWS) Forward Deployed Engineering seeks a Security Engineer to protect production AI systems deployed at customer sites. You will perform security reviews, write tooling, model threats, and implement controls for AI environments.

You will work hands-on writing code, reviewing architectures, and testing systems with mentorship from senior engineers. Expect ownership of real security deliverables from day one while traveling up to 25% to customer sites.

Qualifications

• 2+ years in threat modeling, secure coding, identity management, software development, cryptography, system administration and network security.
• 2+ years troubleshooting systems, logs, or automating tasks with CLI tools (non-internship).
• 2+ years scripting, programming, and security code review in common languages.
• 2+ years experience identifying security issues and developing mitigations.
• 2+ years hands-on experience building AI/agentic systems.

Responsibilities

• Conduct security design reviews, code reviews, and architecture assessments for production AI systems under guidance from senior security engineers.
• Perform threat modeling and penetration testing for AI/ML apps deployed in customer environments and fix vulnerabilities before production.
• Build and maintain security automation: scanning tools, CI/CD gates, guardrail tests, secrets detection, dependency checks.
• Implement security controls for AI threats: prompt injection prevention, data isolation, model endpoint hardening.
• Support security incident response; assist with triage, root-cause analysis, and remediation under senior guidance.
• Document findings and remediation guidance as reusable playbooks and runbooks.
• Contribute to the security accelerator library with reusable modules and reference configurations.
• Willingness to travel up to 25%.

Skills

Threat modeling

Secure coding

Identity management

Software development

Cryptography

System administration

Network security

Scripting/automation

Security code review

AI security

Education

Bachelor's degree in Computer Science or equivalent

Job description

Description

AWS Forward Deployed Engineering (FDE) embeds AI engineers directly inside strategic enterprise customers to design, build, and deploy production-grade AI systems. We are looking for a Security Engineer to join the FDE security team and help secure production AI systems deployed in customer environments.

You will conduct security reviews, write security tooling, perform threat modeling, and implement controls that protect AI systems built by FDE engineers. You work alongside FDE delivery pods in customer environments, getting hands-on with production code, cloud infrastructure, and AI/ML pipelines. You learn fast, ship fast, and build security into the system rather than bolting it on after the fact.

This is a hands-on security engineering role where you spend most of your time writing code, reviewing architectures, and testing systems. You work with senior security engineers who will mentor you, but you own real security deliverables from your first engagement. If you want to learn AI security by doing it, in production, at enterprise scale, this is the role.

This position requires that the candidate selected be a US Citizen.

Key job responsibilities

• Conduct security design reviews, code reviews, and architecture assessments for production AI systems (agentic workflows, RAG pipelines, orchestration layers, model integrations) under guidance from senior security engineers
• Perform threat modeling and penetration testing for AI/ML applications deployed in customer environments; identify vulnerabilities and work with FDE engineers to implement fixes before production release
• Build and maintain security automation: scanning tools, CI/CD security gates, guardrail testing scripts, secrets detection, and dependency vulnerability checks for forward-deployed AI systems
• Implement security controls for AI-specific threats: prompt injection prevention, output filtering, data isolation, model API endpoint hardening, and guardrail configuration
• Support security incident response for FDE-delivered production AI systems; assist with triage, root cause analysis, and remediation under senior engineer guidance
• Document security findings, patterns, and remediation guidance as reusable playbooks and runbooks that benefit future FDE engagements
• Contribute to the FDE security accelerator library: reusable modules, templates, and reference configurations that help FDE engineers build secure AI systems faster
• Requires up to 25% travel

A day in the life

You start the morning running your automated security scan against a new Bedrock-powered application an FDE pod shipped overnight, triaging the findings and filing issues for two real vulnerabilities. Mid-morning you pair with an FDE engineer to fix an IAM policy that's overly permissive for their multi-agent orchestration system. After lunch you're writing a Python script that automates guardrail bypass testing for the team's standard deployment pattern. You close out the day joining a threat modeling session led by a senior security engineer, where you learn how to assess data flow risks in a customer's RAG pipeline. Every week you're working on a different AI architecture, building skills you can't get anywhere else.

About The Team

AWS Forward Deployed Engineering embeds AI engineers directly inside strategic enterprise customers to build production AI systems. AWS invested $1B in this initiative. We move at the speed of the customer: demonstrating ROI in weeks, not quarters. We are customer-obsessed. We lead customers toward outcomes, build together, and leave behind scalable patterns. Security is our enabling function: without it, nothing goes to production. Our culture is people-first, anti-burnout, bold, and engineering-excellence-driven.

About Aws

Diverse Experiences Amazon values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying.

Basic Qualifications

• 2+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience
• 2+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship) experience
• Bachelor's degree in computer science or equivalent
• 2+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• 2+ years of work in identifying security issues and risks, and developing mitigation plans experience
• 2+ years hands on building AI/agentic systems

Preferred Qualifications

• Experience with security in service-oriented architectures/microservices and web services
• US government security clearance of top secret or above
• Experience with compliance & security standards including PCI DSS, ISO 27001, HIPAA, and NIST
• Experience with AWS technologies
• Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company’s reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, CA, Mountain View - 166,600.00 - 212,800.00 USD annually

USA, MA, Boston - 159,300.00 - 202,400.00 USD annually

USA, NY, New York - 159,300.00 - 212,800.00 USD annually

USA, TX, Dallas - 159,300.00 - 202,400.00 USD annually

USA, VA, Arlington - 159,300.00 - 202,400.00 USD annually

USA, WA, Seattle - 159,300.00 - 202,400.00 USD annually