Security Engineer II – AWS Corporate Security Response

About the role

Amazon Corporate Security Response seeks a Security Engineer who blends hands‑on incident response with intelligent automation. You will investigate active threats such as malware, phishing, and credential compromise while shaping an AI‑powered investigation platform that scales beyond human capacity.

Key responsibilities

• Lead end‑to‑end Sev2 security investigations, document findings, and drive issues to resolution.
• Analyze open‑source threat intelligence, validate temporal IOCs, and implement proactive blocking.
• Author and validate user stories for autonomous investigation agents, designing guardrails and policies.
• Build tactical scripts, detection rules, and response automations, then transition them into scalable agentic capabilities.
• Participate in a global on‑call rotation, own the queue during shifts, and ensure clean handoffs.

Required profile

• Bachelor’s degree in computer science or equivalent experience in IT security.
• Hands‑on experience investigating security incidents (malware analysis, phishing response, credential compromise, network intrusion).
• Proficiency in Python or similar scripting language for automation.
• Experience with log analysis platforms (Splunk, ELK) and EDR tools (CrowdStrike, Carbon Black).
• Knowledge of networking protocols (HTTP, DNS, TCP/IP) and Windows/Linux internals.

Required skills

• Python scripting
• Splunk or ELK log analysis
• EDR tools such as CrowdStrike or Carbon Black
• YARA, Sigma detection rule creation
• AWS cloud security concepts
• Threat intelligence platforms (VirusTotal, MITRE ATT&CK)