Security engineer in cloud

Amazon Web Services (AWS); United States; Remote; USD 180,000 - 240,000; Full time

Job summary

Amazon Web Services (AWS) seeks a Senior Security Engineer to join Point-in-Time Security Testing, AWS's expert security assurance function for launches where automation alone is not enough. You will lead complex testing engagements end-to-end, applying human judgment and building automation for other work.

You will own testing strategy across microservice architectures, perform penetration testing and AI-augmented review of AWS software, and guide tooling to trust boundaries and attack paths,

Qualifications

• Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language.
• Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools.
• Experience identifying security issues and risks, and developing mitigation plans.
• Experience in industry-based security vulnerabilities identification, attack patterns, and remediation techniques.
• Experience as a mentor, tech lead or leading an engineering team.
• Experience developing software code in one or more programming languages (Java, Python, etc.).
• Knowledge of information security technologies such as threat modeling, risk analysis, and software testing techniques.
• Knowledge of security technology and concepts (Authentication, Authorization, Single sign-on, Cryptography, etc.).
• Experience in risk assessment and enabling organizations to make security decisions.
• Experience working with operations and business teams to communicate problem impacts and understand business requirements.
• Experience in enterprise software.
• Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline.

Responsibilities

• Own security for a portfolio of testing engagements across teams and partner-orgs.
• Lead complex engagements and set testing strategy across interconnected microservice architectures.
• Perform penetration testing and AI-augmented source code review of complex AWS software.
• Direct tooling toward trust boundaries, abuse cases, and attack paths.
• Document risk hypotheses with conclusions supported by evidence.
• Lead communication with developers and stakeholders when fixes are not straightforward.
• Build reusable frameworks, runbooks, and rubrics for repeatable testing.
• Mentor engineers and participate in promotion assessments.

Skills

Scripting

Programming

Security code review

Log analysis

Automation

Mentorship / Tech lead

Threat modeling

Risk analysis

Security testing

Security design review

Authentication / IAM

Education

Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or related discipline

Tools

Java

Python

CLI tools

Job description

Описание

We are looking for a Senior Security Engineer to join Point-in-Time Security Testing, AWS's expert security assurance function for the launches and architectures where security automation alone is not enough. You will be a technical leader on a team, owning complex security testing engagements end-to-end, applying human judgment where it changes security outcomes and building automation for everything else.

Задачи

Own security for a portfolio of testing engagements across your team and partner-orgs, as well as leading individual complex engagements. Set the testing strategy across interconnected microservice architectures, successive launch iterations, and cross-service campaigns, and decide where to spend expert effort across the whole service portfolio. Perform penetration testing and AI-augmented source code review of complex proprietary AWS software, directing the tooling at trust boundaries, abuse cases, and attack paths it would not reach on its own, confirming what it reports, and setting the methodology your team follows when they do the same. Take each agreed risk hypothesis to a documented conclusion, whether that means demonstrating the issue with proof-of-concept code, ruling out the attack path with sufficient evidence, or identifying a weakness in a shared mechanism or detection that affects services beyond the one under test. Take on engagements where the customer case is understood but no security strategy exists yet, bring clarity to the ambiguity, and define the approach others will reuse. Challenge what a scope document assumes and identify what it misses, then keep the engagement moving when conditions change by building alternative test paths, re-scoping, and parallelizing work with dependent teams. Trace attack paths across chained components and demonstrate compound risk that stays invisible when components are tested in isolation, including risk that crosses organizational and ownership boundaries. Produce clear engagement results that record what you tested, why you chose those tests, what you found or ruled out, the limitations of the work, and the risk that remains, and write for non-engineering audiences in your domain when the decision sits with them. Lead communication with developers, AppSec engineers, and other stakeholders when the scope is ambiguous or a fix is not straightforward, validate the fixes, work as an embedded security tester inside the development lifecycle when a launch calls for it, and lead escalations to closure with Senior Managers and Principal Engineers when a fix or a risk decision stalls. Build the frameworks, runbooks, and rubrics that let the whole team test a new problem domain repeatably, not only automation for a single harness. Tune the harnesses that raise the precision of the team's AI tooling, measure where they produce false positives or miss attack patterns, and generalize what works into a mechanism the team adopts. Leave reusable mechanisms behind, such as fuzzers, integration security tests, detection rules, tooling, or documented methodology, track their adoption, and where the work depends on teams with their own priorities, build the mechanisms that get security outcomes prioritized and tracked to delivery. Set the peer-review bar for the team. Review test plans, scopes, runbooks, and reports from peers and other teams, question coverage gaps, add the missing test cases, and ensure the work fits into the bigger picture and stays extensible and low-cost to adopt. Lead multi-engineer engagements and mentor multiple engineers across your own and related teams, are sought out for your expertise, and participate in promotion assessments.

Требования

• Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language
• Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools
• Experience working in identifying security issues and risks, and developing mitigation plans
• Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
• Experience as a mentor, tech lead or leading an engineering team
• Experience developing software code in one or more programming languages (java, python, etc.)
• Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques
• Knowledge of security technology and concepts (Authentication, Authorization, Single sign-on, Cryptography, etc.)
• Experience in risk assessment and enabling organizations to make security decisions
• Experience working with operations and business teams to communicate problem impacts and understand business requirements
• Experience in enterprise software
• Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline
• Extensive Professional Experience penetration testing, source code auditing, bug hunting, or competitive CTF
• Demonstrated ability to find non-trivial vulnerabilities through offensive testing of web applications and services and through source code review
• Demonstrated mastery of two or more genuinely complex security domains such as networking, workload and tenant isolation, web application and API security, IAM, or cryptography, deep enough to find issues others miss and to encode that expertise into automation
• Experience building and steering AI agents to do useful security work, and reasoning about how those same agentic systems can be attacked

Будет плюсом

• Experience applying threat modeling or other risk identification techniques or equivalent; Experience with security in service-oriented architectures/microservices and web services
• Experience building agentic AI harnesses, orchestrating agents through graphs or swarms, and working with agent-to-agent (A2A) protocols and the security properties of tool use, memory, and model context
• Experience assessing the security of LLM-based or agentic applications, including prompt injection, tool and plugin abuse, and trust boundaries between agents
• Experience performing or supporting Red Team engagements, with an understanding of holistic assessment
• Web service assessment experience across authentication controls, session management, access controls, logic flaws, injection vulnerabilities, request smuggling, cloud privilege escalation, and tenant isolation
• Experience with serverless architectures and common virtualization techniques (hypervisors, containers, jails), including escapes and exploits within those environments
• Experience with micro-service, API-based, or service-oriented architectures
• Experience with full-stack Linux or Unix software architectures from UI to infrastructure
• Operations experience with CI/CD or managing distributed systems
• Experience designing and implementing technical security controls at the business-division level

Условия

You’ll find endless knowledge-sharing, mentorship, training, and other career-advancing resources here to help you develop into a better-rounded professional. We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture.