Security Engineer II - Application Security & Threat Modeling

Amazon; United States; Remote; USD 159,000 - 202,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

Paid time off

Parental leave

Job summary

Amazon is seeking a Security Engineer II for Stores Application Security to collaborate with software teams and help secure services across the portfolio. You will contribute to threat modeling, build security tooling, and guide secure development practices.

The role emphasizes strong communication of risks to both technical and non-technical audiences and leadership by influence within a fast-paced, innovative environment.

Qualifications

• Experience across one or more SDLC security activities (design review, threat modeling, secure code review, security testing).
• Experience with cloud and network architecture, including AWS.
• Proficiency in programming/scripting languages (e.g., Java, Python, Perl, Bash, Ruby, PowerShell).
• Ability to explain complex risks to both technical and non-technical audiences.

Responsibilities

• Create, update, and maintain threat models for diverse software projects.
• Conduct first-party application security research.
• Perform manual and automated secure code reviews (Java, Python, JavaScript).
• Identify and mitigate security issues at scale.
• Develop security automation tools to improve workflows.
• Perform adversarial security analyses to augment manual effort.
• Provide security guidance to internal development teams to secure applications.
• Independently solve security problems with novel methods and approaches.
• Influence team processes, priorities, and choices to improve outcomes.

Skills

Threat modeling

Secure code review

Security design & architecture

Programming/scripting (Java, Python)

Tools

AWS

Job description

Amazon is seeking a Security Engineer II for Stores Application Security to collaborate with software teams and help secure services across the portfolio. You will contribute to threat modeling, build security tooling, and guide secure development practices.

The role emphasizes strong communication of risks to both technical and non-technical audiences and leadership by influence within a fast-paced, innovative environment.