1 day ago
Remote, United KingdomSenior
Responsibilities
- Own security strategy and testing engagements across interconnected AWS services, microservice architectures, launch iterations, and partner organizations.
- Perform penetration testing and AI-augmented source code review of proprietary AWS software, focusing on trust boundaries, abuse cases, and complex attack paths.
- Investigate risk hypotheses to documented conclusions by demonstrating vulnerabilities, ruling out attack paths, or identifying weaknesses in shared mechanisms and detections.
- Trace compound risks across chained components and organizational boundaries, and adapt scopes and testing plans as conditions change.
- Produce clear engagement reports covering test rationale, findings, ruled-out risks, limitations, and remaining risk for technical and non-technical audiences.
- Lead communication with developers, AppSec engineers, and stakeholders; validate fixes and drive stalled risk decisions to closure.
- Build reusable security frameworks, runbooks, rubrics, fuzzers, integration tests, detection rules, tooling, and AI-agent harnesses.
- Review peers' test plans, scopes, runbooks, and reports; lead multi-engineer engagements, mentor engineers, and participate in promotion assessments.
Requirements
- Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or a related discipline.
- Non-internship experience with scripting, programming, security code review, system troubleshooting, log analysis, command-line automation, vulnerability identification, and remediation planning.
- Experience with industry security vulnerabilities, attack patterns, penetration testing, source code auditing, bug hunting, or competitive CTFs.
- Experience mentoring, serving as a technical lead, or leading an engineering team.
- Experience developing software in one or more programming languages, including Java or Python.
- Knowledge of security design review, threat modeling, risk analysis, software testing techniques, authentication, authorization, single sign-on, and cryptography.
- Experience assessing risk, communicating business impact, and enabling security decisions with operations and business teams.
- Demonstrated ability to find non-trivial web application and service vulnerabilities through offensive testing and source code review.
- Mastery of at least two complex security domains such as networking, workload and tenant isolation, web application and API security, IAM, or cryptography.
- Experience building and steering AI agents for security work and reasoning about attacks against agentic systems.
- Preferred experience includes threat modeling, service-oriented and microservice architectures, agentic AI harnesses, A2A protocols, LLM application security, Red Team engagements, web service assessment, serverless and virtualization security, Linux or Unix architectures, distributed systems, and technical security controls.
Benefits
- Mentorship, knowledge-sharing, training, and career-advancement resources.
- Flexible work-life culture supporting work-life harmony.
- Ongoing diversity, equity, and inclusion events and learning experiences.
About Amazon
Amazon builds and operates a global e-commerce marketplace, logistics network, and consumer devices, and provides cloud computing via AWS for businesses and developers. The company earns revenue from online retail, third‑party seller services, subscriptions like Prime, advertising, and AWS usage. Founded in 1994 and headquartered in Seattle, it is publicly traded on NASDAQ (AMZN) and serves customers in dozens of countries.