3 days ago
Melbourne, AustraliaMid Level
Responsibilities
- Lead Sev2 security investigations end-to-end through detection, investigation, containment, remediation, documentation, and resolution.
- Triage Sev2 candidates and promote or downgrade incidents with documented rationale.
- Investigate malware campaigns, phishing, credential compromise, network intrusions, lateral movement, and other threats.
- Extract IOCs, perform host forensics, analyze threat intelligence, and scope impact across multiple data sources.
- Author and validate investigation user stories for autonomous security agents.
- Design and test guardrails and policies to prevent agent failures and attacker evasion.
- Build tactical scripts, detection rules, and response automations, and transition successful patterns into scalable agentic capabilities.
- Participate in the global on-call rotation, monitor operational health, own the shift queue, and execute clean handoffs.
Requirements
- Bachelor's degree in computer science or equivalent, or experience in IT security.
- Experience in security operations, incident response, or security engineering.
- Hands-on experience investigating security incidents such as malware, phishing, credential compromise, or network intrusion.
- Proficiency in Python or a similar scripting language for security automation and tooling.
- Experience with log analysis platforms such as Splunk or ELK and EDR tools such as CrowdStrike or Carbon Black.
- Knowledge of HTTP, DNS, TCP/IP, Windows, and Linux internals.
- Preferred experience in detection engineering supporting incident response and threat intelligence.
- Preferred experience designing or validating AI/LLM-powered automation in a security context.
- Preferred specialization in malware analysis/reverse engineering, digital forensics, security tool development and automation, network and OS security, or identity management.
- Preferred experience with threat intelligence platforms, IOC enrichment, detection rules, AWS, and cloud security.
- Security certifications such as GCIH, GCFA, GREM, or OSCP are a plus but not required.
Benefits
- Global follow-the-sun 24/7 operating model with each engineer owning a defined shift rather than carrying a pager continuously.
- Growth opportunity combining hands-on security practice, technical leadership, and influence over an AI-augmented security platform.
- Inclusive culture and workplace accommodation support during hiring and onboarding.
About Amazon
Amazon builds and operates a global e-commerce marketplace, logistics network, and consumer devices, and provides cloud computing via AWS for businesses and developers. The company earns revenue from online retail, third‑party seller services, subscriptions like Prime, advertising, and AWS usage. Founded in 1994 and headquartered in Seattle, it is publicly traded on NASDAQ (AMZN) and serves customers in dozens of countries.