Security Engineer I, AWS Security Incident Response

About the role

As part of the AWS Applied AI Solutions organization, you will help accelerate customers’ businesses by delivering intuitive, turnkey technology solutions. In the Security Engineer I position you will investigate suspicious activity, drive security response efforts, and communicate technical findings to both technical and non‑technical audiences. You will also enhance existing automations and contribute to AI‑augmented investigation tools and new forensic capabilities.

Responsibilities

• Respond to threat findings that indicate unauthorized activity, performing triage and escalating issues as appropriate.
• Identify, evaluate, and communicate security threats, risks, and vulnerabilities, and recommend remediation actions to reduce risk.
• Contribute to security automation, scripting, and tooling efforts—including AI‑augmented investigation tools—to improve triage and response capabilities.
• Track and report on the effectiveness of AWS detective controls such as Amazon GuardDuty and partner products (e.g., CrowdStrike Falcon, Wiz Defend).
• Develop and refine runbooks, processes, and policies that strengthen security response effectiveness.
• Review alerts and triage potential threats across customer environments, investigate suspicious findings using AWS‑native tools, document analysis, and coordinate remediation with service teams.
• Participate in threat research, improve triage using signals from security partners, and prepare threat‑intelligence briefings for customers.

About the team

AWS Security Incident Response is a 24/7 team of security engineers and incident responders that provides threat monitoring, investigation, and response for customers running workloads on AWS. The team leverages signals from security partners and Trust & Safety Abuse to improve triage and prevent harm, protecting environments ranging from startups to large enterprises. Members regularly present at industry forums such as AWS re:Invent and deliver threat‑intelligence briefings. Growth paths include automation development, threat research, partner work, and contributions to internal AWS security tooling.

Basic qualifications

• 2+ years of experience with web protocols, common security attacks, and remediation (non‑internship).
• Bachelor’s degree in Engineering, Computer Science, or a related field.
• Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and exploit development.
• Experience solving basic problems by writing code or scripts with some assistance.

Preferred qualifications

• Experience with AWS services or other cloud offerings.
• Experience with AWS services in a security context (e.g., Amazon GuardDuty, AWS CloudTrail, AWS Security Hub, AWS IAM).
• Familiarity with AI/ML concepts such as confidence scoring, feedback loops, and training data.
• Experience contributing to detection engineering, security automation, or building tools that improve security operations.

Culture and work environment

AWS values diverse experiences and encourages candidates from non‑traditional backgrounds to apply. The company promotes work‑life harmony with flexible work hours and arrangements. An inclusive team culture is fostered through employee‑led affinity groups, ongoing learning events, mentorship, and career‑advancing resources.

Benefits

• Comprehensive health insurance (medical, dental, vision, prescription).
• Basic Life & AD&D insurance with optional supplemental life plans.
• Employee Assistance Program and mental‑health support.
• Medical advice line, Flexible Spending Accounts, and adoption/surrogacy reimbursement.
• 401(k) matching.
• Paid time off and parental leave.

Pay

Base salary range: $136,000 – $184,000 USD annually (USA, WA, Seattle). Total compensation includes sign‑on payments and restricted stock units (RSUs) and is determined based on experience, qualifications, and location.