1 day ago
Melbourne, AustraliaSenior
Responsibilities
- Lead high-severity security investigations from detection and triage through containment, remediation, documentation, and resolution.
- Investigate malware campaigns, phishing, credential compromise, network intrusions, and novel attack patterns using host forensics, IOC extraction, multiple data sources, and lateral-movement analysis.
- Analyze open-source threat intelligence and validate or block time-sensitive indicators of compromise.
- Author and validate agent investigation user stories and ensure autonomous investigations meet human-quality standards.
- Design and test guardrails and policies for AI-powered investigation agents, including adversarial and edge-case scenarios.
- Build tactical scripts, detection rules, and response automations, and transition effective patterns into scalable agentic capabilities.
- Participate in a global follow-the-sun on-call rotation, monitor operational health, own the incident queue, and perform clean shift handoffs.
Requirements
- Bachelor’s degree in computer science or equivalent, or experience in IT Security.
- Experience in security operations, incident response, or security engineering.
- Hands-on experience investigating security incidents such as malware analysis, phishing response, credential compromise, or network intrusion.
- Proficiency in Python or a similar scripting language for security automation and tooling.
- Experience with log analysis platforms such as Splunk or ELK and EDR tools such as CrowdStrike or Carbon Black.
- Knowledge of HTTP, DNS, TCP/IP, Windows, and Linux internals.
- Preferred experience in detection engineering supporting incident response and threat intelligence operations.
- Preferred experience designing or validating AI/LLM-powered automation in a security context.
- Preferred proficiency in malware analysis/reverse engineering, digital forensics, security tool development and automation, network and OS security, or identity management.
- Preferred experience with threat intelligence platforms and IOC enrichment, including VirusTotal and MITRE ATT&CK.
- Security certifications such as GCIH, GCFA, GREM, or OSCP are a plus but not required.
Benefits
- Global follow-the-sun operating model with shift ownership rather than carrying a pager continuously.
- Opportunity to combine hands-on security incident response with leadership and development of an AI-augmented investigation platform.
- Inclusive culture with equal-opportunity employment and workplace accommodation support.
About Amazon
Amazon builds and operates a global e-commerce marketplace, logistics network, and consumer devices, and provides cloud computing via AWS for businesses and developers. The company earns revenue from online retail, third‑party seller services, subscriptions like Prime, advertising, and AWS usage. Founded in 1994 and headquartered in Seattle, it is publicly traded on NASDAQ (AMZN) and serves customers in dozens of countries.