3 days ago
Remote, United KingdomSenior
Responsibilities
- Develop testable adversarial hypotheses from threat intelligence, scanner output, past findings, and other real-world signals.
- Perform penetration testing of live AWS services and internal systems, including AI-assisted source code review.
- Research novel attack techniques, chained attack paths, and compound risks across multiple components.
- Create safe, reproducible proof-of-concept work to prove or rule out impact.
- Work with service teams, SecOps, and AppSec to resolve findings, validate fixes, and check for bypasses.
- Create lasting defenses such as fleet-wide detections, security canaries, fuzzers, and documented testing methods.
- Build and tune harnesses for AI testing tools and measure missed attack patterns and false positives.
- Adversarially test agentic AI systems, including tool use, memory, agent-to-agent communication, and orchestration.
- Document testing scope, findings, ruled-out risks, and remaining risk clearly.
- Peer review engineering scopes and findings and mentor engineers and apprentices.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, or a related field, or equivalent professional experience.
- Experience applying threat modeling or other risk-identification techniques.
- Experience performing offensive testing of web applications and services and conducting source-code review.
- Ability to script solutions and deploy code in an enterprise environment.
- Experience with AWS technologies and services, including S3, Lambda, EC2, KMS, and IAM.
- Professional experience in penetration testing, source-code auditing, bug hunting, or CTFs.
- Demonstrable depth in at least two security domains, such as IAM, web application and API security, networking, or workload and tenant isolation.
- Experience finding security issues in multiple languages, including one or more of Java, Python, JavaScript, Rust, Ruby, and C.
- Experience developing code in Python or an equivalent language, including boto3.
- Ability to support conclusions with data and evidence.
- Preferred: experience scaling findings into campaigns or detections across many systems.
- Preferred: experience using AI tools or LLMs for security research and evaluating their limitations.
- Preferred: experience working with threat intelligence or detection teams.
- Preferred: experience performing or supporting Red Team engagements.
- Preferred: experience running an initiative such as a CTF or apprenticeship.
Benefits
- Flexible work hours and arrangements are part of the team culture.
- Ongoing DEI events and learning experiences are available.
- Knowledge-sharing, training, and career-advancing resources are provided.
- The role offers exposure to security challenges across cloud, devices, retail, entertainment, healthcare, operations, and physical stores.
- Amazon provides workplace accommodations and adjustments during hiring and onboarding when needed.
About Amazon
Amazon builds and operates a global e-commerce marketplace, logistics network, and consumer devices, and provides cloud computing via AWS for businesses and developers. The company earns revenue from online retail, third‑party seller services, subscriptions like Prime, advertising, and AWS usage. Founded in 1994 and headquartered in Seattle, it is publicly traded on NASDAQ (AMZN) and serves customers in dozens of countries.