Sr. Security Engineer, AppSec

Cybersecurity Jobs; Seattle (WA); On-site; USD 180,000 - 230,000; Full time

Benefits offered by this job

Health insurance

401(k) matching

Paid time off

Parental leave

Job summary

Amazon Security in Seattle is seeking a Senior Security Engineer in AppSec to deepen expertise across cloud, retail technologies, operations, and physical stores, collaborating with software teams to build secure services and protect customer trust.

You will perform threat modeling, secure code review in Java, Python, and JavaScript, and develop automation tools while training internal teams and guiding security architecture across partnerships.

Qualifications

• 4+ years of troubleshooting systems issues, analyzing logs, or automating tasks using command line tools.
• 5+ years identifying security issues and risks, and developing mitigation plans.
• 4+ years scripting, programming, and security code review in common languages.

Responsibilities

• Create, update, and maintain threat models for various software projects.
• Perform manual and automated secure code review in Java, Python, and JavaScript.
• Develop security automation tools to improve outcomes at scale.
• Conduct adversarial security analysis using innovative tooling.
• Provide security training and outreach for internal development teams.
• Deliver security architecture and design guidance to partners.
• Independently solve security problems with novel methods.
• Influence team priorities and decisions to improve security results.

Skills

Troubleshooting

Security issues

Scripting

Languages

Vulnerabilities

Domain experience

Application security

Job description

Amazon Security supports a company-wide focus on customer trust by setting a high bar for security across Amazon products and services. In Amazon Stores, you will collaborate with software development teams as they build novel services, helping keep customers safe while enabling secure delivery.

This onsite Senior Security Engineer role in AppSec in Seattle offers opportunities to deepen expertise across areas like cloud, retail technologies, entertainment, healthcare, operations, and physical stores, while working in an environment that emphasizes learning, curiosity, and work-life harmony.

What you’ll do

• Create, update, and maintain threat models for a wide variety of software projects.
• Perform manual and automated secure code review, primarily in Java, Python, and JavaScript.
• Develop security automation tools to improve security outcomes at scale.
• Conduct adversarial security analysis using innovative tooling to augment manual effort.
• Provide security training and outreach for internal development teams.
• Deliver security architecture and design guidance to partners.
• Independently solve security problems that call for novel methods or approaches.
• Influence team and partner process, priorities, and decisions to improve security results.

Key requirements

• 4+ years (non-internship) troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools.
• 5+ years (work) identifying security issues and risks, and developing mitigation plans.
• 4+ years (non-internship) scripting, programming, and security code review in common programming languages.
• Knowledge of at least two of: Scala, Java, Python, C/C++, Go.
• Experience (non-internship) identifying industry security vulnerabilities, attack patterns, and remediation techniques.
• Experience in one or more domains: access-control system and methodology, network security, application- and system-development security, security architecture and models, cryptography, operations security.
• 8+ years of application security or development experience.

Preferred qualifications

• Experience with security in service-oriented architectures, microservices, and web services.
• Certifications such as CCSP (Certified Cloud Security Professional), CEH (Certified Ethical Hacker), CFR (CyberSec First Responder), Cloud+, CySA+ (CompTIA Cybersecurity Analyst), GCED (GIAC Certified Enterprise Defender), GICSP (Global Industrial Cyber Security Professional), or PenTest+.

Benefits and support

• Health insurance including medical, dental, vision, prescription, Basic Life & AD&D, with options for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, and Adoption and Surrogacy Reimbursement coverage.
• 401(k) matching.
• Paid time off.
• Parental leave.

Amazon Security is built around ongoing learning and inclusive team culture, including DEI events and learning experiences that encourage curiosity and celebrate diverse ideas, perspectives, and voices. The organization also invests in resources that innovate to reduce on-call time and keep the team focused on highest-value work.

The work culture emphasizes flexibility and work-life harmony, with success at work not coming at the expense of sacrifices at home.

Training and career growth

Amazon continues raising performance expectations while supporting knowledge-sharing, training, and other career-advancing resources to help you develop into a better-rounded professional.

Technologies

Java, Python, JavaScript, Scala, C/C++, Go, and command line tools.