7 days ago
Milan, ItalySenior
Responsibilities
- Lead complex security testing engagements end to end, including multi-engineer, repeat-launch, and systemic-risk campaigns.
- Perform penetration testing and AI-augmented source-code review, focusing on trust boundaries, abuse cases, and difficult attack paths.
- Document conclusions for risk hypotheses by demonstrating issues, ruling out attack paths, or identifying weaknesses in shared mechanisms and detections.
- Trace chained attack paths, assess business impact, produce engagement reports, and validate remediation through Verification of Fixes.
- Build and tune automation and AI pentest harnesses, test agentic AI systems, and measure false positives and missed attack patterns.
- Create reusable fuzzers, integration security tests, detection rules, tooling, and documented methodologies.
- Lead communication with developers, AppSec engineers, and blue teams; peer-review testing materials; and mentor engineers.
Requirements
- Bachelor's degree in Computer Science, Cybersecurity, or a related field, or equivalent professional experience.
- Professional experience in penetration testing, source-code auditing, bug hunting, or CTF activities.
- Offensive testing experience with web applications and services and source-code review for non-trivial security issues.
- Experience with AWS technologies and services, including S3, Lambda, EC2, KMS, and IAM.
- Depth in at least two security domains such as networking, workload and tenant isolation, web application and API security, or identity and access management.
- Working competence in security architecture and engineering, communications and network security, IAM, security assessment and testing, cryptography, and software development security.
- Experience finding security issues in multiple languages, including one or more of Java, Ruby, Python, JavaScript, Rust, and C.
- Development experience using Python or an equivalent language and demonstrable experience with boto3.
- Preferred qualifications include Red Team experience, full-stack Linux/Unix architectures, serverless and virtualization environments, microservice or API architectures, distributed systems, and web-service security assessment.
Benefits
- Knowledge-sharing, mentorship, training, and career-development resources.
- Work-life harmony and flexibility in the working culture.
- Statutory and applicable company supplementary benefits, subject to relevant terms and collective bargaining agreements.
- Full-time position; the stated salary is pro-rated for part-time hours.
About Amazon
Amazon builds and operates a global e-commerce marketplace, logistics network, and consumer devices, and provides cloud computing via AWS for businesses and developers. The company earns revenue from online retail, third‑party seller services, subscriptions like Prime, advertising, and AWS usage. Founded in 1994 and headquartered in Seattle, it is publicly traded on NASDAQ (AMZN) and serves customers in dozens of countries.