Security Engineer II, AWS Security Incident Response

In this role you join AWS Security Incident Response to detect, triage and respond to security threats at scale. You will collaborate with security engineers and partner teams to improve detection, automation and response capabilities, while communicating complex concepts to non-technical audiences. The work focuses on protecting AWS customers by handling incidents, refining processes and ensuring robust security postures. This is a hands-on role that combines technical expertise with clear, actionable risk remediation and on-call responsibility.

• flexible work hours and arrangements
• learning experiences and ongoing training
• mentorship and knowledge-sharing culture
• conferences and diversity/affinity group participation
• inclusive workplace culture
• opportunities for career growth and advancement

• Respond to threat findings indicating unauthorized activity
• Identify, evaluate, and communicate threats, risks and remediation recommendations
• Contribute to security automation and security posture improvements
• Track and report on effectiveness of detective controls (GuardDuty, CrowdStrike Falcon, Wiz Defend)
• Develop processes and policies to boost security response effectiveness
• On-call support including weekends
• Monitor networks and systems for threats, perform triage, document activity, and report issues for remediation

• Bachelor's degree in computer science or equivalent
• Knowledge of networking protocols (HTTP, DNS, TCP/IP)
• Knowledge of security vulnerabilities and remediation techniques
• Experience in scripting, programming, and security code reviewing in a common language
• 3+ years of programming in an OO language (e.g., Python, Ruby, Go, Java, C++, etc.)
• 3+ years of scripting, programming, and security code review experience
• 3+ years of troubleshooting, logs analysis, or automating tasks via command line tools

• Ability to work in a team and explain security concepts to non-technical audiences
• Comfort handling ambiguity and making concrete remediation decisions
• Strong communication and collaboration skills
• Experience with AWS services or other cloud offerings
• Experience triaging security alerts and front-line analysis
• Security certifications (e.g., GCIH, GSEC, Security+, CISSP, CISA, CISM)