Security Engineer, Compliance Penetration Testing

About the Role

Amazon Stores Security is hiring a Security Engineer for our Application Security Compliance Penetration Testing (CPT) team. In this role, you will attack Amazon's services, applications, and websites to find security issues and work directly with the owning technology teams to resolve them. Your testing will be driven by Amazon's regulatory and compliance commitments, ensuring Amazon's ability to operate in regulated markets. Your reports will be read by external auditors and internal teams.

Responsibilities

• Conducting high-quality penetration tests independently or as part of a team
• Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations
• Contributing to team tooling, innovation, and improvements
• Communicating and collaborating with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings

Qualifications

• Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or 2+ years of IT Security experience
• 3+ years of experience performing hands-on application penetration testing or offensive security assessments across web applications, APIs, or cloud services
• Experience manually identifying, exploiting, and documenting application vulnerabilities, including authentication, authorization, business logic, and input validation flaws
• Experience writing penetration test reports and communicating findings, severity, and remediation guidance directly to software development teams
• 2+ years of scripting or programming experience in Python, Go, Java, Ruby, or a similar language (non-internship)

Preferred Qualifications

• Experience with AWS products and services
• Experience building security automation, such as scripting or tooling that automates testing, finding triage, reporting, or evidence collection
• Working knowledge of regulatory or compliance frameworks (e.g., PCI DSS, SOX, MAS TRM, RBI, GDPR) and their application to penetration testing scope and evidence
• Experience testing service-oriented or RPC-based backend services in addition to web front ends
• Familiarity with testing standards such as OWASP ASVS, OWASP Top 10, or PTES
• Experience using AI or LLM-assisted tooling to accelerate security testing
• Offensive security certification (e.g., OSCP, OSWE, GPEN, PenTest+)

About the Team

Amazon Security values diverse experiences. We encourage candidates to apply even if they do not meet all qualifications. Our team culture emphasizes learning, curiosity, and inclusivity. We address tough security challenges by embracing diverse ideas, perspectives, and voices. We offer continuous training, career growth, and work-life balance to support our team’s success.

Location: Virtual Location - Texas, USA
Company: Amazon.com Services LLC
Pay Range: $159,300.00 - $202,400.00 USD annually