Security Engineer, Compliance Penetration Testing

Summary

Amazon is hiring a Security Engineer for its Application Security Compliance Penetration Testing team. The role conducts penetration tests against services, applications, and websites, documents security findings and remediation recommendations, improves testing tooling, and collaborates with technology teams and leadership to resolve security issues and meet regulatory commitments.

Responsibilities

• Conducting high quality penetration tests independently, or as part of a team
• Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations
• Contributing to team tooling, innovation, and improvements
• Communicating and collaborating with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings

Skills

• • Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or experience in IT Security
• • 2+ years of scripting language, or 2+ years of non-internship professional software development experience
• • Knowledge of networking protocols such as HTTP, DNS and TCP/IP
• • 3+ years of hands-on application penetration testing or offensive security assessments across web applications, APIs, or cloud services (non-internship) experience
• • Experience manually identifying, exploiting, and documenting application vulnerabilities, including authentication, authorization, business logic, and input validation flaws
• • Experience writing penetration test reports and communicating findings, severity, and remediation guidance directly to software development teams
• • Experience performing security activities across one or more phases of the software development lifecycle (SDLC), such as security design review, threat modeling, secure code review, and security testing
• • Experience with AWS products and services
• • Experience testing service-oriented or RPC-based backend services in addition to web front ends
• • Experience building security automation, for example scripting or tooling that automates testing, finding triage, reporting, or evidence collection
• • Experience using AI or LLM-assisted tooling to accelerate security testing
• • Working knowledge of one or more regulatory or compliance frameworks such as PCI DSS, SOX, MAS TRM, RBI, or GDPR, and how their requirements translate into penetration testing scope and evidence
• • Familiarity with recognized testing standards such as OWASP ASVS, OWASP Top 10, or PTES
• • Offensive security certification such as OSCP, OSWE, GPEN, or PenTest+

Qualifications

Must Haves

• • Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or experience in IT Security
• • 2+ years of scripting language, or 2+ years of non-internship professional software development experience
• • Knowledge of networking protocols such as HTTP, DNS and TCP/IP
• • 3+ years of hands-on application penetration testing or offensive security assessments across web applications, APIs, or cloud services (non-internship) experience
• • Experience manually identifying, exploiting, and documenting application vulnerabilities, including authentication, authorization, business logic, and input validation flaws
• • Experience writing penetration test reports and communicating findings, severity, and remediation guidance directly to software development teams

Nice to Haves

• • Experience performing security activities across one or more phases of the software development lifecycle (SDLC), such as security design review, threat modeling, secure code review, and security testing
• • Experience with AWS products and services
• • Experience testing service-oriented or RPC-based backend services in addition to web front ends
• • Experience building security automation, for example scripting or tooling that automates testing, finding triage, reporting, or evidence collection
• • Experience using AI or LLM-assisted tooling to accelerate security testing
• • Working knowledge of one or more regulatory or compliance frameworks such as PCI DSS, SOX, MAS TRM, RBI, or GDPR, and how their requirements translate into penetration testing scope and evidence
• • Familiarity with recognized testing standards such as OWASP ASVS, OWASP Top 10, or PTES
• • Offensive security certification such as OSCP, OSWE, GPEN, or PenTest+

Benefits

• Sign-on payments
• Restricted stock units (RSUs)
• Health insurance, including medical, dental, vision, and prescription coverage
• Basic Life & AD&D insurance
• Option for Supplemental life plans
• Employee Assistance Program (EAP)
• Mental Health Support
• Medical Advice Line
• Flexible Spending Accounts
• Adoption and Surrogacy Reimbursement coverage
• 401(k) matching
• Paid time off
• Parental leave
• Ongoing DEI events and learning experiences
• Knowledge-sharing, training, and other career-advancing resources
• Flexible work hours and arrangements