Security Engineer, AWS Security Incident Response

About the role

The Security Engineer in AWS Security Incident Response works with a global team to protect AWS customers by detecting, investigating, and responding to security threats. You will use AWS services and partner tools to monitor environments, triage alerts, and implement remediation actions while continuously improving detection and response capabilities.

Key responsibilities

• Hold or obtain an Australian Government Security Vetting Agency clearance.
• Respond to threat findings indicating unauthorized activity.
• Identify and recommend solutions to enhance AWS SIR capabilities and security automation.
• Provide security engineering support during customer‑facing incidents and help prevent future incidents.
• Mentor and collaborate with information security engineers to reduce risk.
• Identify, evaluate, and communicate security threats, risks, and vulnerabilities, proposing remediation.
• Track and report on the effectiveness of detective controls such as Amazon GuardDuty, CrowdStrike Falcon, and Wiz Defend.
• Develop processes and policies to increase security response effectiveness.
• Participate in periodic on‑call rotation, including weekends.

Required profile

• 3+ years of experience troubleshooting systems, analyzing logs, or automating tasks with command‑line tools (non‑internship).
• 3+ years of programming experience in Python and Ruby.
• Ability to work through ambiguity, explain technical concepts to non‑technical audiences, and collaborate in a team environment.

Required skills

• Python
• Ruby
• Command‑line tooling
• AWS services (e.g., GuardDuty)
• CrowdStrike Falcon
• Wiz Defend
• Security incident response
• Threat detection and security automation