Senior Security Engineer, AWS Security Verification & Validation Team

Role overview

Key job responsibilities

• Own a portfolio of security testing engagements and set testing strategy across interconnected services and launch iterations.
• Perform penetration testing and AI-augmented source code review of proprietary AWS software.
• Take risk hypotheses to documented conclusions using proof-of-concept code or sufficient evidence.
• Define approaches for ambiguous engagements, adapt scope, and coordinate parallel work with dependent teams.
• Trace attack paths across chained components and demonstrate compound risk across organizational boundaries.
• Produce reports describing tests, rationale, findings, limitations, and remaining risk.
• Lead stakeholder communication, validate fixes, and drive stalled risk decisions or fixes to closure.
• Build reusable frameworks, runbooks, rubrics, fuzzers, detection rules, tooling, and testing methodology.
• Review peer work, lead multi-engineer engagements, mentor engineers, and participate in promotion assessments.

Basic qualifications

• Experience developing software in one or more programming languages, such as Java or Python.
• Knowledge of security design review, threat modeling, risk analysis, and software testing techniques.
• Knowledge of authentication, authorization, single sign-on, cryptography, and related security concepts.
• Experience in risk assessment and working with operations and business teams.
• Experience in enterprise software.
• Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or a related discipline.
• At least 5 years of professional penetration testing, source code auditing, bug hunting, or competitive CTF experience.
• Demonstrated ability to identify non-trivial vulnerabilities through offensive testing and source code review.
• Mastery of at least two complex security domains.
• Experience building and steering AI agents for security work and reasoning about attacks against agentic systems.

Preferred qualifications

• Experience building agentic AI harnesses and using agent-to-agent protocols.
• Experience assessing LLM-based or agentic applications, including prompt injection and tool abuse.
• Experience performing or supporting red team engagements.
• Experience assessing web services, serverless architectures, virtualization, microservices, APIs, Linux or Unix systems, CI/CD, or distributed systems.
• Experience designing and implementing technical security controls at business-division level.

Workplace

• The posting identifies the role as remote.

About AWS Security