Security Engineer, Field Innovation, Security Search and Observability (SSO)
About the role
with. Next: The Opportunity ... This is a dual-facing role... etc. Could be part of responsibilities or about the role. Might be better as Responsibilities. Let's extract responsibilities: "Your impact here will be immediate and visible. You'll ship features that directly change how customers run their businesses, and you'll see the impact of your work in weeks, not years. The team is small enough that your decisions carry real weight and large enough that you'll always have someone to learn from. This is a dual-facing role. On the field side, you'll work directly with customers to implement the latest features of our security services, leading threat-modeling sessions, performing vulnerability assessments with security agents, and guiding remediation. On the partner side, you'll work with leading third-party security providers to identify their highest-signal findings and turn them into correlated, high-fidelity detections. Across both, you'll design and implement detection content, reduce false positives at scale, and expand coverage across cloud resources, runtime, and AI/ML workloads. Everything you learn in the field feeds back into the product. AI is not a side experiment on this team. It's a core part of the stack. You'll build with large language models, AI-assisted development tools, security agents, agent frameworks, and retrieval-augmented generation as everyday engineering primitives." Then "Key job responsibilities" list bullet points: Run early-access and gated previews of our newest AI-powered capabilities with customers, including threat modeling, vulnerability assessment using security agents, and remediation guidance. Work backwards from customers to shape detection coverage and influence service roadmaps, feeding field and partner insights back to science and engineering teams. Drive detection engineering best practices, including security-value evaluation, false-positive reduction, and coverage measurement. Stay current with the evolving cloud security and threat landscape, including emerging threats targeting agentic AI and ML applications. Collaborate across science, engineering, partner, and field teams, operating with flexible hours to support global customers and distributed stakeholders. Thus responsibilities section can include those bullet points. Now Basic Qualifications: list items: 3+ years of scripting, programming, and security code review in a common programming language (non-internship) experience; 3+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship) experience; Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or 3+ years of IT Security experience; Knowledge of industry-based security vulnerabilities and remediation techniques; Experience in scripting, programming, and security code reviewing in a common programming language (non-internship); Experience in troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship experience). There's duplication: first two items repeated later. We need to preserve all substantive info but avoid duplication? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." It doesn't say we must deduplicate, but we should not repeat duplicated lines? It says "Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions." So we should remove duplicated lines. So we need to deduplicate the qualifications. Thus Basic Qualifications unique items: - 3+ years of scripting, programming, and security code review in a common programming language (non-internship) experience - 3+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship) experience - Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or 3+ years of IT Security experience - Knowledge of industry-based security vulnerabilities and remediation techniques We could also include "Experience in scripting, programming, and security code reviewing in a common programming language (non-internship)" which is same as first. So drop duplicate. Now Preferred Qualifications: list: - 3+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience - Experience with AWS products and services - Experience in scripting, programming, or security code reviewing in a common language, such as Python, Java, or C++ - Experience performing security activities across one or more phases of the software development lifecycle (SDLC), such as security design review, threat modeling, secure code review, and security testing - Experience working in a customer-facing role Now Benefits: The posting includes: "Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits." Thus we have benefits content. Pay: The posting includes salary ranges for various locations: "USA, CA, Santa Clara - 166,600.00 - 212,800.00 USD annually USA, TX, Austin - 159,300.00 - 202,400.00 USD annually USA, VA, Arlington - 159,300.00 - 202,400.00 USD annually USA, WA, Bellevue - 159,300.00 - 202,400.00 USD annually USA, WA, Seattle - 159,300.00 - 202,400.00 USD annually". Also mention sign-on payments and RSUs. So we have pay info. Schedule: Not explicitly mentioned. There's "operating with flexible hours to support global customers and distributed stakeholders." That's about flexible hours, could be schedule. But schedule section only if posting actually states them. It mentions flexible hours, which is schedule-related. So we could include a Schedule section with that note. But we must not create Schedule section unless posting actually states them. It does state flexible hours. So we can include. Now we need to output HTML fragment with sections as needed. Use
for section headings. Use - for any list of duties/requirements/benefits, and
for prose.
We need to decide which sections to include: About the role, Responsibilities, Requirements (maybe Basic Qualifications), Qualifications (Preferred Qualifications), Skills (maybe not separate; we could combine skills into qualifications? But we have no explicit skills list separate. Could omit Skills if no specific content. Benefits, Pay, Schedule.
We must not create sections with filler text. So we include only those with real content.
Thus sections:
- About the role (prose)
- Responsibilities (list)
- Requirements (Basic Qualifications) (list)
- Qualifications (Preferred Qualifications) (list)
- Benefits (list maybe)
- Pay (list maybe)
- Schedule (prose about flexible hours)
We need to ensure we don't repeat job title. Not include Job ID.
Now format.
Let's craft About the role paragraph: combine the initial description paragraphs (maybe two paragraphs). Could be one
containing all.
Responsibilities: list items from "Key job responsibilities" plus maybe the earlier dual-facing role description? But that is also responsibilities. We'll include the bullet points from Key job responsibilities. Also maybe include the earlier dual-facing role description as part of responsibilities? But to avoid duplication, we can include the bullet points only. However the earlier dual-facing role description includes responsibilities like "work directly with customers to implement the latest features..., leading threat-modeling sessions, performing vulnerability assessments with security agents, and guiding remediation." etc. That is also responsibility. The bullet points include similar but not exactly. To preserve all substantive info, we should include that content as well. But we can incorporate into responsibilities list as items.
Let's extract all responsibility statements:
From earlier dual-facing role paragraph:
- work directly with customers to implement the latest features of our security services
- leading threat-modeling sessions
- performing vulnerability assessments with security agents
- guiding remediation
- work with leading third-party security providers to identify their highest-signal findings and turn them into correlated, high-fidelity detections
- design and implement detection content
- reduce false positives at scale
- expand coverage across cloud resources, runtime, and AI/ML workloads
- Everything you learn in the field feeds back into the product. (maybe not a duty)
- AI is not a side experiment... You'll build with large language models, AI-assisted development tools, security agents, agent frameworks, and retrieval-augmented generation as everyday engineering primitives. (maybe skill)
But we can treat as responsibilities.
From Key job responsibilities bullet list:
- Run early-access and gated previews of our newest AI-powered capabilities with customers, including threat modeling, vulnerability assessment using security agents, and remediation guidance.
- Work backwards from customers to shape detection coverage and influence service roadmaps, feeding field and partner insights back to science and engineering teams.
- Drive detection engineering best practices, including security-value evaluation, false-positive reduction, and coverage measurement.
- Stay current with the evolving cloud security and threat landscape, including emerging threats targeting agentic AI and ML applications.
- Collaborate across science, engineering, partner, and field teams, operating with flexible hours to support global customers and distributed stakeholders.
We should combine and deduplicate.
Let's create a unified list:
- Work directly with customers to implement the latest features of security services
- Lead threat-modeling sessions
- Perform vulnerability assessments using security agents
- Guide remediation
- Work with leading third-party security providers to identify highest-signal findings and turn them into correlated, high-fidelity detections
- Design and implement detection content
- Reduce false positives at scale
- Expand coverage across cloud resources, runtime, and AI/ML workloads
- Run early-access and gated previews of newest AI-powered capabilities with customers (including threat modeling, vulnerability assessment using security agents, and remediation guidance) – maybe similar to above but we can keep.
- Work backwards from customers to shape detection coverage and influence service roadmaps, feeding field and partner insights back to science and engineering teams
- Drive detection engineering best practices, including security-value evaluation, false-positive reduction, and coverage measurement
- Stay current with evolving cloud security and threat landscape, including emerging threats targeting agentic AI and ML applications
- Collaborate across science, engineering, partner, and field teams, operating with flexible hours to support global customers and distributed stakeholders
We could keep both "Run early-access..." and the earlier items; they may be similar but not duplicate exactly. We'll keep both
for prose. We need to decide which sections to include: About the role, Responsibilities, Requirements (maybe Basic Qualifications), Qualifications (Preferred Qualifications), Skills (maybe not separate; we could combine skills into qualifications? But we have no explicit skills list separate. Could omit Skills if no specific content. Benefits, Pay, Schedule. We must not create sections with filler text. So we include only those with real content. Thus sections: - About the role (prose) - Responsibilities (list) - Requirements (Basic Qualifications) (list) - Qualifications (Preferred Qualifications) (list) - Benefits (list maybe) - Pay (list maybe) - Schedule (prose about flexible hours) We need to ensure we don't repeat job title. Not include Job ID. Now format. Let's craft About the role paragraph: combine the initial description paragraphs (maybe two paragraphs). Could be one
containing all. Responsibilities: list items from "Key job responsibilities" plus maybe the earlier dual-facing role description? But that is also responsibilities. We'll include the bullet points from Key job responsibilities. Also maybe include the earlier dual-facing role description as part of responsibilities? But to avoid duplication, we can include the bullet points only. However the earlier dual-facing role description includes responsibilities like "work directly with customers to implement the latest features..., leading threat-modeling sessions, performing vulnerability assessments with security agents, and guiding remediation." etc. That is also responsibility. The bullet points include similar but not exactly. To preserve all substantive info, we should include that content as well. But we can incorporate into responsibilities list as items. Let's extract all responsibility statements: From earlier dual-facing role paragraph: - work directly with customers to implement the latest features of our security services - leading threat-modeling sessions - performing vulnerability assessments with security agents - guiding remediation - work with leading third-party security providers to identify their highest-signal findings and turn them into correlated, high-fidelity detections - design and implement detection content - reduce false positives at scale - expand coverage across cloud resources, runtime, and AI/ML workloads - Everything you learn in the field feeds back into the product. (maybe not a duty) - AI is not a side experiment... You'll build with large language models, AI-assisted development tools, security agents, agent frameworks, and retrieval-augmented generation as everyday engineering primitives. (maybe skill) But we can treat as responsibilities. From Key job responsibilities bullet list: - Run early-access and gated previews of our newest AI-powered capabilities with customers, including threat modeling, vulnerability assessment using security agents, and remediation guidance. - Work backwards from customers to shape detection coverage and influence service roadmaps, feeding field and partner insights back to science and engineering teams. - Drive detection engineering best practices, including security-value evaluation, false-positive reduction, and coverage measurement. - Stay current with the evolving cloud security and threat landscape, including emerging threats targeting agentic AI and ML applications. - Collaborate across science, engineering, partner, and field teams, operating with flexible hours to support global customers and distributed stakeholders. We should combine and deduplicate. Let's create a unified list: - Work directly with customers to implement the latest features of security services - Lead threat-modeling sessions - Perform vulnerability assessments using security agents - Guide remediation - Work with leading third-party security providers to identify highest-signal findings and turn them into correlated, high-fidelity detections - Design and implement detection content - Reduce false positives at scale - Expand coverage across cloud resources, runtime, and AI/ML workloads - Run early-access and gated previews of newest AI-powered capabilities with customers (including threat modeling, vulnerability assessment using security agents, and remediation guidance) – maybe similar to above but we can keep. - Work backwards from customers to shape detection coverage and influence service roadmaps, feeding field and partner insights back to science and engineering teams - Drive detection engineering best practices, including security-value evaluation, false-positive reduction, and coverage measurement - Stay current with evolving cloud security and threat landscape, including emerging threats targeting agentic AI and ML applications - Collaborate across science, engineering, partner, and field teams, operating with flexible hours to support global customers and distributed stakeholders We could keep both "Run early-access..." and the earlier items; they may be similar but not duplicate exactly. We'll keep both