Sr. Security Engineer, AppSec - Amazon Stores Security

About the role

As a Senior Security Engineer in Amazon Stores, you will collaborate with software development teams to keep customers safe while building novel services. Your day may involve inspecting application code for security issues, creating frameworks that enable faster and more secure development, or refining service designs alongside developers. The role requires a security generalist with deep expertise in one or more areas, the ability to influence by clear communication, and the skill to prioritize risks and guide partners toward secure solutions. Amazon invests in work‑life harmony, reducing on‑call time and focusing the team on high‑value tasks.

Responsibilities

• Create, update, and maintain threat models for a wide variety of software projects.
• Perform manual and automated secure code reviews, primarily in Java, Python, and JavaScript.
• Develop security automation tools.
• Conduct adversarial security analysis using innovative tools to augment manual effort.
• Provide security training and outreach for internal development teams.
• Offer security architecture and design guidance.
• Independently solve security problems that require novel methods or approaches.
• Influence team and partner processes, priorities, and choices to improve outcomes.

About the team

Amazon Security values diverse experiences and encourages candidates from non‑traditional backgrounds to apply. The organization maintains a high security bar across all Amazon products and services, offering opportunities to work on cloud, devices, retail, entertainment, healthcare, operations, and physical stores. The team fosters an inclusive culture with ongoing DEI events, knowledge‑sharing, training, and career‑advancing resources. Work‑life harmony is emphasized, with flexibility and support for both professional and personal success.

Basic qualifications

• 4+ years of non‑internship experience troubleshooting system issues, analyzing logs, or automating complex tasks using command‑line tools.
• 5+ years of experience identifying security issues and risks, and developing mitigation plans.
• 4+ years of non‑internship scripting, programming, and security code review in common programming languages.
• Knowledge of at least two of the following languages: Scala, Java, Python, C/C++, or Go.
• Non‑internship experience with industry‑based security vulnerability identification, attack patterns, and remediation techniques.
• Experience in one or more domains: access‑control systems and methodology, network security, application‑ and system‑development security, security architecture and models, cryptography, or operations security.
• 8+ years of application security or development experience.

Preferred qualifications

• Experience with security in service‑oriented architectures/microservices and web services.
• Relevant certifications such as CCSP, CEH, CFR, Cloud+, CySA+, GCED, GICSP, or PenTest+.

Pay

Base salary range: $178,400.00 – $226,700.00 USD annually. Compensation includes sign‑on payments and restricted stock units (RSUs). Final compensation is determined based on experience, qualifications, and location.

Benefits

• Comprehensive health insurance (medical, dental, vision, prescription).
• Basic Life & AD&D insurance with optional supplemental life plans.
• Employee Assistance Program (EAP) and mental health support.
• Medical advice line.
• Flexible Spending Accounts.
• Adoption and surrogacy reimbursement coverage.
• 401(k) matching.
• Paid time off.
• Parental leave.