Senior AppSec Engineer — Threat Modeling & Secure Code

Amazon; Seattle (WA); On-site; USD 178,000 - 227,000; Full time

Job summary

Amazon Stores is seeking a Senior Security Engineer to partner with software teams to keep customers safe while building innovative services. You may review code for security issues, develop frameworks to accelerate secure development, or shape designs for new services with engineers.

The role requires a security generalist with deep expertise areas and the ability to communicate risks clearly to both technical and non-technical audiences.

Qualifications

• 5+ years of work identifying security issues and developing mitigation plans.
• 4+ years of non-internship experience troubleshooting systems, analyzing logs, or automating tasks using command line tools.
• 4+ years of scripting, programming, and security code review in common languages.
• Knowledge of at least two languages among Scala, Java, Python, C/C++, or Go.
• Experience identifying vulnerabilities, attack patterns, and remediation techniques.
• 4+ years in related security domains (e.g., app security, cloud security, threat intel, pentesting).

Responsibilities

• Create, update, and maintain threat models for various software projects.
• Perform manual and automated secure code review (Java, Python, JavaScript).
• Develop security automation tools.
• Conduct adversarial security analysis with innovative tools.
• Provide security training and outreach to internal teams.
• Offer security architecture and design guidance.
• Independently solve security problems requiring novel methods.
• Influence teams and partners on security priorities and processes.

Skills

Security risk identification

Secure code review

Automation scripting

Threat modeling

Technical communication

Job description

Amazon Stores is seeking a Senior Security Engineer to partner with software teams to keep customers safe while building innovative services. You may review code for security issues, develop frameworks to accelerate secure development, or shape designs for new services with engineers.

The role requires a security generalist with deep expertise areas and the ability to communicate risks clearly to both technical and non-technical audiences.