Security Engineer-Pentest, Continuous Security Testing

Overview

In this role you contribute to AWS CST by turning real-world signals into testable security hypotheses, testing live services with AI-augmented methods, and shaping durable defenses. You work across service teams to validate fixes and scale findings into fleet-wide detections, all while exploring novel attack paths. The work blends offensive testing with AI tooling to stay ahead of adversaries and protect production systems. You join a cross-functional, high-impact team dedicated to elevating security postures at scale.

Pay / Benefits

• flexible work hours
• career growth and training
• inclusive culture
• focus on security leadership
• DEI events
• privacy and data protection awareness

Responsibilities

• Turn real-world signals into testable hypotheses about adversary thinking in production systems
• Test live AWS services and internal systems with penetration testing and AI-assisted source code review
• Invent new techniques and research areas
• Assess whether findings apply across systems and validate end-to-end impact with reproducible PoCs
• Trace attack paths across chained components to reveal compound risk
• Lead findings to resolution with service teams, SecOps, and AppSec
• Turn discoveries into lasting defenses such as fleet-wide detections and fuzzers
• Build and tune AI testing tool harnesses and assess AI coverage of attack patterns
• Test agentic AI systems as adversaries (tool use, memory, inter-agent interactions)
• Document test results and risk with clear justifications
• Peer review scopes and mentor junior engineers

Key requirements

• Experience applying threat modeling or risk identification techniques
• Offensive testing of web applications and services and source code review
• Scripting and deploying code in an enterprise environment
• Experience with AWS technologies and services (e.g. S3, Lambda, EC2, KMS, IAM)
• Data-driven with evidence-based conclusions
• Bachelor’s degree in Computer Science, Cybersecurity, or related field, or equivalent experience
• Experience in professional penetration testing, source code auditing, bug hunting, or CTF
• Depth in at least two complex security domains (IAM, web/API security, networking, or workload/tenant isolation)
• Experience finding security issues in multiple languages (Java, Python, JavaScript, Rust, Ruby, C)
• Experience in Python or equivalent language development (including boto3)

• curiosity and creative problem solving
• ability to work independently and with cross-functional teams
• clear written communication and reporting
• Threat modeling
• Penetration testing
• Source code auditing

…