Security Incident Response Engineer, AWS Security Corporate Response

About the role

AWS Corporate Security Response is looking for a Security Engineer who combines hands-on incident response with intelligent automation. You will investigate active threats such as malware campaigns, phishing, credential compromise and novel attack patterns, while helping to build an agentic investigation platform that scales response beyond what a human team can achieve alone. Investigations run from detection through containment and remediation, and you will also act as a demanding customer of the AI-powered investigation platform.

Key responsibilities

• Lead high-severity security investigations end-to-end, triage candidates and promote or downgrade them with documented rationale
• Analyze open-source threat intelligence and validate temporal IOCs rapidly
• Author and validate agent investigation user stories so autonomous investigations meet human-quality rigor
• Design and test guardrails and policies, anticipating evasion techniques and edge cases
• Build tactical scripts, detection rules and response automations, then drive them into scalable agentic capabilities
• Participate in a global on-call rotation, own the queue for your shift and execute clean handoffs

Required profile

• Bachelor's degree in computer science or equivalent, or experience in IT security
• Experience in security operations, incident response or security engineering
• Hands-on incident investigation experience (malware analysis, phishing response, credential compromise, network intrusion)
• Knowledge of networking protocols (HTTP, DNS, TCP/IP) and Windows and Linux internals

Required skills

• Proficiency in Python or a similar scripting language for security automation
• Log analysis platforms (Splunk, ELK or equivalent) and EDR tools (CrowdStrike, Carbon Black or equivalent)
• Preferred: detection engineering, AI/LLM-powered security automation, malware analysis, digital forensics, security tool development, threat intelligence platforms (VirusTotal, MITRE ATT&CK)
• Certifications such as GCIH, GCFA, GREM or OSCP are a plus

The team works 24/7 in a follow-the-sun model, combining human expertise with autonomous investigation capabilities. The role sits within Amazon Corporate Services.