Security Engineer, Compliance Penetration Testing

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We need to parse the job description. Key parts: - Description: Amazon Stores Security hiring a Security Engineer for Application Security Compliance Penetration Testing (CPT) team. Role: attack Amazon's services, applications, and websites to find security issues, work with owning tech teams to resolve. CPT testing driven by regulatory/compliance commitments; findings support ability to operate in regulated markets; reports read by external auditors and internal teams. Direct contact with teams across business verticals, giving first-hand knowledge of how Amazon is built and operated at deep technical level. Use that knowledge to find new ways to break services, processes, and technologies across company, and improve tooling the team tests with. Engineers expected to show good judgment in making trade-offs between short term fixes and long term security goals, navigate ambiguous situations with composure, bring strong sense of customer obsession to work of keeping Amazon and its customers secure. - Key job responsibilities: bullet list: Conducting high quality penetration tests independently, or as part of a team Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations Contributing to team tooling, innovation, and improvements Communicating and collaborating with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings - About The Team: includes subsections: Diverse Experiences, Why Amazon Security?, Inclusive Team Culture, Training & Career Growth, Work/Life Balance. These are more about team culture, but we can treat as "About the Team" maybe not required heading? The instruction says use headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should map content to those headings. - Basic Qualifications: list of qualifications. - Preferred Qualifications: list. - Benefits: mention comprehensive benefits including health insurance..., 401(k) matching, paid time off, parental leave. Also mention sign-on payments and RSUs. - Pay: base salary range listed: USA, NY, Virtual Location - New York - 159,300.00 - 202,400.00 USD annually. Also mention sign-on payments and RSUs. - Schedule: not mentioned explicitly. There's flexible work hours and arrangements part of culture under Work/Life Balance. Could be considered schedule? The instruction says only include Schedule if posting actually states them. It mentions flexible work hours and arrangements are part of culture. That is somewhat schedule info. Might include Schedule section with that detail. However they said "Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture." That is schedule info. So we can include Schedule section with that. - Skills: maybe we can extract from qualifications: knowledge of networking protocols, programming languages, etc. Could be a Skills section. - Requirements: maybe Basic Qualifications. - Qualifications: maybe Preferred Qualifications. We need to avoid repeating job title as heading. Also no Job ID etc. We must remove boilerplate: EEO, equal opportunity, accommodation link, etc. Also remove duplicated lines, application instructions. We must preserve all substantive information; do not invent or summarize away detail. We need to output only HTML fragment, no /, no markdown fences. We'll produce sections:

About the role

with paragraph(s) summarizing role description.

Responsibilities

with

• list.

  Requirements

  (Basic Qualifications) with
  • .

    Qualifications

    (Preferred Qualifications) with
    • .

      Skills

      maybe combine knowledge of networking protocols, programming languages, etc. Could be derived from Basic Qualifications but we already have Requirements. Might be redundant. Perhaps we can omit Skills if not distinct. But instruction: Prefer a few substantive sections over many thin ones. So we could combine Requirements and Qualifications into one? But they are distinct: Basic vs Preferred. Could still have two sections. We also need Benefits and Pay and Schedule. Benefits: list health insurance etc. Pay: base salary range and sign-on payments and RSUs. Schedule: flexible work hours and arrangements. We must not include filler like "commensurate with experience". Not present. Let's extract exact text. From description: "Amazon Stores Security is hiring a Security Engineer for our Application Security Compliance Penetration Testing (CPT) team. In this role you will attack Amazon's services, applications, and websites to find security issues, and work directly with the owning technology teams to get them resolved. CPT's testing is driven by Amazon's regulatory and compliance commitments, which means your findings support Amazon's ability to operate in regulated markets, and your reports are read by external auditors as well as internal teams. You will be in direct contact with teams across a range of business verticals, which gives you first hand knowledge of how Amazon is built and operated at a deep technical level. You will use that knowledge to find new ways to break services, processes, and technologies across the company, and to improve the tooling the team tests with. Engineers in this role are expected to show good judgment in making trade-offs between short term fixes and long term security goals, to navigate ambiguous situations with composure, and to bring a strong sense of customer obsession to the work of keeping Amazon and its customers secure." That's the role description. Responsibilities list: - Conducting high quality penetration tests independently, or as part of a team - Creating detailed engagement plans and thoroughly documenting findings, gaps, and remediation recommendations - Contributing to team tooling, innovation, and improvements - Communicating and collaborating with partner teams, service owners, Information Security, and senior leadership to influence, prioritize, and drive the resolution of discovered security findings About The Team sections: we may not need to include as separate heading; but some content like "Diverse Experiences", "Why Amazon Security?", "Inclusive Team Culture", "Training & Career Growth", "Work/Life Balance". Could be considered part of "About the role" or maybe we can omit because not required headings. However we need to preserve ALL substantive information. If we omit those, we lose info. But we could incorporate them into a section like "About the Team" but instruction only lists specific headings; but we could still include a heading like "About the Team" if not in list? The instruction says: use

      for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). It gives examples but not exclusive? It says "use

      for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." Likely they expect only those headings. So we should map the team info into appropriate sections: maybe "About the role" can include some team culture? But better to create a section "About the Team" is not listed; maybe we should avoid. However we must preserve all substantive information. Could we embed that info within "About the role" paragraph? That would be mixing but still preserve. The instruction: "Prefer a few substantive sections over many thin ones." So we could combine team info into About the role or maybe into Responsibilities? Probably About the role is appropriate to include role and team context. Thus we can expand About the role paragraph to include team culture details: Diverse Experiences, Why Amazon Security?, Inclusive Team Culture, Training & Career Growth, Work/Life Balance. But we need to be careful not to invent or summarize away detail. We can paraphrase but must preserve meaning. Summarizing is allowed as long as we don't lose detail? The instruction says "do NOT invent or summarize away detail." That suggests we should not omit details; summarizing may lose detail. Safer to keep the details as is, maybe as bullet list under a heading like "About the Team". But heading not in list; maybe we can still use

      for "About the Team" as it's a section heading. The instruction gave examples but not exclusive list; it says "use

      for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." That implies those are typical but not exhaustive. However later: "IMPORTANT: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text". So we can include any heading as long as there is real content. So we can include "About the Team". That seems safe. Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule, About the Team. But we need to avoid too many thin sections. However each has substantive content. Let's extract each. About the role: we have the paragraph. Responsibilities: list. Requirements (Basic Qualifications): - Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or experience in IT Security - Knowledge of networking protocols such as HTTP, DNS and TCP/IP - 3+ years of hands-on application penetration testing or offensive security assessments across web applications, APIs, or cloud services (non-internship) experience - 2+ years of programming or scripting in Python, Go, Java, C++, or a similar language (non-internship) experience - Experience manually identifying, exploiting, and documenting application vulnerabilities, including authentication, authorization, business logic, and input validation flaws - Experience writing penetration test reports and communicating findings, severity, and remediation guidance directly to software development teams Qualifications (Preferred Qualifications): - Experience performing security activities across one or more phases of the software development lifecycle (SDLC), such as security design review, threat modeling, secure code review, and security testing - Experience with AWS products and services - Experience testing service-oriented or RPC-based backend services in addition to web front ends - Experience building security automation, for example scripting or tooling that automates testing, finding triage, reporting, or evidence collection - Experience using AI or LLM-assisted tooling to accelerate security testing - Working knowledge of one or more regulatory or compliance frameworks such as PCI DSS, SOX, MAS TRM, RBI, or GDPR, and how their requirements translate into penetration testing scope and evidence - Familiarity with recognized testing standards such as OWASP ASVS, OWASP Top 10, or PTES - Offensive security certification such as OSCP, OSWE, GPEN, or PenTest+ Skills: Could be derived from both sets but maybe we can combine knowledge of networking protocols, programming languages, etc. However we already have those in Requirements. Might be redundant. Could omit Skills section. But we need to include Skills if we have specific content. The posting mentions "Knowledge of networking protocols such as HTTP, DNS and TCP/IP" and "2+ years of programming or scripting in Python, Go, Java, C++, or a similar language". Those are skills. Could create Skills section with those items. However they'd duplicate Requirements. Might be considered thin. Better to omit Skills and keep Requirements and Qualifications. Benefits: "Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave." Also mention sign-on payments and RSUs under compensation but that's Pay. Pay: "The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location." Then location line: "USA, NY, Virtual