About This Role
This senior security engineering role is within AWS's expert security assurance function, focusing on complex security testing for launches and architectures where automation alone is insufficient. The engineer will act as a technical leader, owning end-to-end security testing engagements, applying human judgment, and building automation for repeatable tasks. The position involves leading a portfolio of testing engagements, defining testing strategies across interconnected microservice architectures, and performing penetration testing and AI-augmented source code reviews.
Responsibilities
- Own security for a portfolio of testing engagements across your team and partner organizations
- Lead individual complex engagements and set the testing strategy across interconnected microservice architectures, successive launch iterations, and cross-service campaigns
- Perform penetration testing and AI-augmented source code review of complex proprietary AWS software, directing tooling at trust boundaries, abuse cases, and attack paths
- Confirm tooling reports and set the methodology for the team's security testing
- Take each agreed risk hypothesis to a documented conclusion, demonstrating issues with proof-of-concept code, ruling out attack paths, or identifying weaknesses in shared mechanisms
- Take on engagements where the customer case is understood but no security strategy exists yet, bringing clarity and defining reusable approaches
- Challenge scope document assumptions, identify omissions, and keep engagements moving when conditions change by building alternative test paths, re-scoping, and parallelizing work
- Trace attack paths across chained components and demonstrate compound risk that crosses organizational and ownership boundaries
- Produce clear engagement results that record tests, rationale, findings, limitations, and remaining risk, writing for non-engineering audiences when decisions sit with them
- Lead communication with developers, AppSec engineers, and other stakeholders when scope is ambiguous or a fix is not straightforward
- Validate fixes, work as an embedded security tester inside the development lifecycle when needed, and lead escalations to closure with Senior Managers and Principal Engineers when a fix or risk decision stalls
- Build frameworks, runbooks, and rubrics for repeatable testing of new problem domains, not just automation for a single harness
- Tune harnesses to raise the precision of the team's AI tooling, measure false positives or missed attack patterns, and generalize effective mechanisms for team adoption
- Leave reusable mechanisms behind, such as fuzzers, integration security tests, detection rules, tooling, or documented methodology
- Track the adoption of reusable mechanisms and build mechanisms to prioritize and track security outcomes to delivery when work depends on other teams
