Security Engineer, Compliance Penetration Testing

Amazon is a company of builders and problem solvers. The Compliance Penetration Testing team, part of Amazon Security, is seeking a Security Engineer to join the team. As a member of the Compliance Penetration Testing team, you will independently and collectively with a team of highly skilled penetration testers, assess Amazon’s services, applications, and websites to uncover vulnerabilities and improve the security posture for Amazon customers. You will work closely with Amazon’s service owners and partner teams to identify risks and remediation paths. You will write detailed reports that communicate vulnerabilities and remediation options to a wide range of technical and non-technical audiences. This is an excellent opportunity to join Amazon’s world-class information security team, working with some of the best and brightest engineers and technical leaders in the industry, while also developing your skills and furthering your career within one of the most innovative and progressive technology companies anywhere. Our team owns the full product and development lifecycle for Amazon’s compliance penetration testing capability. This includes identifying services and applications that require testing, performing the tests, and documenting our findings for owning teams and external auditors. We are a diverse team of security professionals with a passion for finding security vulnerabilities and helping teams fix them. We are looking for a candidate who is passionate about security, has a strong technical background, and is a great team player. Key Job Responsibilities Perform compliance penetration tests against Amazon’s services, applications, and websites. Independently assess the security posture of Amazon’s services, applications, and websites. Document and report vulnerabilities and remediation options to owning teams and external auditors. Contribute to the development of the team’s testing tools and processes. About the Team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Inclusive Team Culture Here at Amazon, we embrace our differences. We are committed to furthering our culture of inclusion. We have ten employee-led affinity groups, reaching 40,000 employees in over 190 chapters globally. We have innovative benefit offerings, and host annual and ongoing learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences. Amazon’s culture of inclusion is reinforced within our 16 Leadership Principles, which remind team members to seek diverse perspectives, learn and be curious, and earn trust. Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Basic Qualifications 3+ years of experience in penetration testing or related security role Experience with penetration testing tools and techniques, including network, web application, and cloud security testing Experience with at least one programming or scripting language (e.g., Python, Java, C++, etc.) Knowledge of security vulnerabilities and attack vectors, including OWASP Top 10, SANS Top 25, and other industry standards Experience with security assessment methodologies, including risk assessment, threat modeling, and vulnerability management Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience Preferred Qualifications Experience with compliance frameworks, including PCI DSS, SOC 2, ISO 27001, and other industry standards Experience with cloud security, including AWS, Azure, and GCP Experience with container security, including Docker and Kubernetes Experience with API security testing Experience with mobile application security testing Relevant security certifications, such as OSCP, OSCE, GPEN, GWAPT, or similar Experience with security automation and scripting Strong written and verbal communication skills, with the ability to communicate complex security concepts to technical and non-technical audiences Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. The base salary range for this position is listed below. Your Amazon package will include sign-on bonus and Restricted Stock Units (RSUs). Your compensation will be a combination of base pay and equity and will be determined based on your experience, skills, and location. Learn more about our benefits at https://amazon.jobs/en/benefits . USA, NY, Virtual Location – New York – 159,300.00 – 202,400.00 USD annually Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $159,300/year in our lowest geographic market up to $202,400/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://amazon.jobs/en/benefits .