Senior Security Engineer, AWS Security Verification & Validation Team

We are looking for a Senior Security Engineer to join Point-in-Time Security Testing, AWS's expert security assurance function for the launches and architectures where security automation alone is not Basic qualifications: - Experience developing software code in one or more programming languages (java, python, etc.) - Knowledge of information security technologies such as security design review, threat modeling, risk analysis, and software testing techniques - Knowledge of security technology and concepts (Authentication, Authorization, Single sign-on, Cryptography, etc.) - Experience in risk assessment and enabling organizations to make security decisions - Experience working with operations and business teams to communicate problem impacts and understand business requirements - Experience in enterprise software - Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline - 5+ years in professional penetration testing, source code auditing, bug hunting, or competitive CTF - Demonstrated ability to find non-trivial vulnerabilities through offensive testing of web applications and services and through source code review - Demonstrated mastery of two or more genuinely complex security domains such as networking, workload and tenant isolation, web application and API security, IAM, or cryptography, deep enough to find issues others miss and to encode that expertise into automation - Experience building and steering AI agents to do useful security work, and reasoning about how those same agentic systems can be attacked Preferred: - Experience building agentic AI harnesses, orchestrating agents through graphs or swarms, and working with agent-to-agent (A2A) protocols and the security properties of tool use, memory, and model context - Experience assessing the security of LLM-based or agentic applications, including prompt injection, tool and plugin abuse, and trust boundaries between agents - Experience performing or supporting Red Team engagements, with an understanding of holistic assessment - Web service assessment experience across authentication controls, session management, access controls, logic flaws, injection vulnerabilities, request smuggling, cloud privilege escalation, and tenant isolation - Experience with serverless architectures and common virtualization techniques (hypervisors, containers, jails), including escapes and exploits within those environments - Experience with micro-service, API-based, or service-oriented architectures - Experience with full-stack Linux or Unix software architectures from UI to infrastructure - Operations experience with CI/CD or managing distributed systems - Experience designing and implementing technical security controls at the business-division level Amazon is an equal opportunities employer. We believe passionately that employing a diverse workforce is central to our success. We make recruiting decisions based on your experience and skills. We value your passion to discover, invent, simplify and build. Protecting your privacy and the security of your data is a longstanding top priority for Amazon. Please consult our Privacy Notice ( https://www.amazon.jobs/en/privacy_page ) to know more about how we collect, use and transfer the personal data of our candidates. Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.