Applied Scientist II, AWS Security

About the role

At Amazon, Security is a top priority. Are you interested in shaping the future of security for AWS, our customers, and the broader open source community? Do you want to be part of building something with massive impact? Our AWS Security Customer Outcomes Team is looking for a strong applied scientist as we help improve the security of open source software and the safety of the software supply chain generally. We're looking for an ambitious team member who will bring added scientific rigor and innovation to how our customer's experience security with and through open source software. Our systems operate on a global scale across a diverse ecosystem of field teams, security requirements, and tooling which requires high velocity security innovation that scales. We are seeking an Applied Scientist to help define, design, build, and operate AI-powered security solutions across the full lifecycle of open source software usage. You will work alongside a team to build intelligent automation that augments manual identification, analysis, and remediation workflows, enforces security controls for agents and human experts, and provides data-driven insights to AWS leadership.

Responsibilities

• Architect and build AI-powered security applications and tooling — Design and implement LLM-based systems (leveraging Bedrock, SageMaker, and state of the art patterns) for intelligent code scanning, automated solution development/deployment, and remediation alternatives.
• Transform manual processes – Reimagine and deliver change from low throughput, human-dependent processes into high volume, machine speed pipelines without sacrificing key quality metrics.
• Collaborate with and influence other leaders – The open source ecosystem has many stakeholders, and change requires listening and supporting but also influencing and leading through action.
• Drive proactive security automation — Build systems that identify and remediate security issues in deliverables (code, threat models, content) without requiring explicit builder consent at every step, moving from reactive reviews to proactive prevention.
• Own operational excellence — Define and maintain SLAs, monitoring, alerting, runbooks, and incident response for services you own; participate