Application Security Engineer

Make a measurable impact on customer trust as part of Amazon’s Information Security team. This onsite role in Seattle pairs hands-on application security reviews with security design and testing for critical services, plus incident response and guidance for builders. You will also join an on-call rotation and help deliver security solutions that protect systems, networks, and applications at scale.

Benefits and support are built for the long term, including sign-on payments, restricted stock units (RSUs), health insurance coverage (medical, dental, vision, prescription, Basic Life & AD&D insurance, option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, parental leave, and flexible work hours and arrangements.

Responsibilities

• Preserve Amazon customer trust through application security reviews and security improvements
• Perform application security reviews of critical systems and services
• Engineer security solutions to protect systems, networks, and applications
• Conduct security design and testing of the most critical Amazon applications
• Respond to security violations, vulnerabilities, and event detection systems
• Provide security policy guidance and consultations for teams building and operating software
• Be an advocate for customer trust by evangelizing security within Amazon
• Participate in a team on-call rotation
• Provide security guidance and support to Amazon builders
• Develop and deliver projects that raise the security bar at scale
• Work closely with partner teams, stakeholders, and builders to drive company-wide security improvements
• Troubleshoot, maintain, and improve internal team tooling to reduce overhead and improve efficiency

Requirements

• 3+ years of programming experience in Python, Ruby, Go, Swift, Java, .Net, C++, or a similar object-oriented language
• 2+ years of scripting, programming, and security code review experience in a common programming language (non-internship)
• 2+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship)
• Bachelor’s degree in a STEM field (Science, Technology, Engineering, Mathematics), or 2+ years of IT Security experience
• Knowledge of networking protocols such as HTTP, DNS, and TCP/IP
• Knowledge of industry-based security vulnerabilities and remediation techniques
• Knowledge of usage or integration experience with common cloud-hosted services
• Knowledge of command line tools to troubleshoot protocols, analyze log outputs, or automate basic tasks
• Experience with AWS products and services
• Experience performing security activities across one or more phases of the SDLC, such as security design review, threat modeling, secure code review, and security testing

Team culture

• Diverse Experiences: Amazon Security values diverse experiences and encourages candidates to apply even if not every qualification is met.
• Inclusive Team Culture: ongoing DEI events and learning experiences, with an emphasis on diverse ideas, perspectives, and voices to address the toughest security challenges.
• Training & Career Growth: knowledge-sharing, training, and other career-advancing resources.
• Work/Life Balance: flexible work hours and arrangements.

Technologies: Python, Ruby, Go, Swift, Java, .Net, C++, HTTP, DNS, TCP/IP