Security Engineer II - Threat Modeling & Secure Coding

Amazon; Virginia (IL); On-site; USD 159,000 - 202,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

RSUs

Flexible work options

Career growth

Job summary

Amazon Security is seeking a Security Engineer to collaborate with software teams, inspecting code for security issues and building frameworks for faster, safer development. You’ll lead threat modeling, security research, and scalable defenses while communicating risk to both technical and non-technical audiences.

The role emphasizes driving secure design and practices across the SDLC, with opportunities to influence processes and mentor teams in a dynamic, diverse environment.

Qualifications

• Experience performing security activities across SDLC phases such as design review, threat modeling, secure code review, and security testing.
• Bachelor's degree in CS or equivalent, or 3+ years IT Security experience.
• Experience with network architecture and cloud such as AWS.
• Proficiency in programming or scripting languages (e.g., Java, Python, Perl, Bash, Ruby, PowerShell).

Responsibilities

• Create, update, and maintain threat models for multiple software projects.
• Conduct first-party application security research.
• Perform manual and automated secure code reviews in Java, Python, and JavaScript.
• Identify and mitigate security issues at scale.
• Develop security automation tools to speed up reviews and testing.
• Provide security guidance to internal software teams to secure apps.

Skills

Threat modeling

Secure code review

Security research

Risk communication

Security automation

Adversarial analysis

Education

Bachelor's degree in CS or equivalent

3+ years IT Security experience

Tools

Java

Python

JavaScript

AWS

Job description

Amazon Security is seeking a Security Engineer to collaborate with software teams, inspecting code for security issues and building frameworks for faster, safer development. You’ll lead threat modeling, security research, and scalable defenses while communicating risk to both technical and non-technical audiences.

The role emphasizes driving secure design and practices across the SDLC, with opportunities to influence processes and mentor teams in a dynamic, diverse environment.