Demonstrate high capacity for managing priorities appropriately while remaining productive and effective, with tolerance for context switching and interruptions
Escalate issues early and often, expressing a high degree of security judgement when issues are not progressing at the correct pace based on impact to ensure we are putting customers first.
Design and build automation that reduces manual toil in incident response, from triage to remediation tracking.
Design agentic systems and frameworks that let AI reason over security context and take action safely within incident response.
Explore and embrace the Amazon builder culture, identifying mechanisms and methods to improve tools and processes to simplify and drive issues at the scale and speed necessary to benefit our global team of engineers.
Fulfill regular on-call responsibilities during the team's working hours and in support of the global team's on-call weekend rotation
A day in the life
This position supports AWS with security operations and incident response activities. You will be responsible for coordinating and facilitating security response activities for all AWS products and services. You will drive security related issues to resolution across numerous service teams and engineer scalable solutions to automate incident response activities.
Each day, your team picks up the shift from the region that worked before you, starting by reviewing what's open and setting priorities for the day, before handing the shift on to the next region at the end of the day. You'll drive response on the issues you pick up, digging in until you understand the real risk rather than settling for the first plausible read, and when a decision carries real weight, you'll walk it through with your manager before committing to a path. You'll write clearly and precisely as you go, since the next person picking up an issue is relying entirely on what you left behind. Alongside the daily grind, you'll also be chipping away at your own project work, whether that's building a tool to cut down on manual toil or automating a piece of the incident response process that used to take up half your day. Shifts are aligned to the US Pacific time (PST/PDT, accounting for daylight savings across summer and winter).
About the team
Cloud Response is a team inside AWS Security Operations. This team is broadly responsible for the 'AWS' side of the Shared Responsibility Model, and provides oversight of security issues from their identification through to resolution. Cloud Response operates follow-the-sun with teams based around four different geographical locations.
We work with AWS security and service teams to ensure security issues are addressed and resolved with the right level of urgency, while keeping our key stakeholders informed and engaged as necessary throughout the issue lifecycle. We also optimize our own operations by building tools and automation that let the team scale response capacity faster than incident volume grows.
We don't settle for a surface-level read on a security issue. We dig in until we understand the real risk, bring the right security expertise to the table, and partner with service teams to land on a clear path to resolution, whether that's a quick fix or a longer-term remediation. As our understanding of a class of issue matures, we push ownership back to the service teams best placed to own it long-term, while staying closely engaged wherever ambiguity remains.
The team is in the middle of a significant transformation, rebuilding how we work around AI and agentic frameworks that reason over security context and take action alongside our engineers. This is reshaping what the job looks like day to day, and there's real room to shape that direction rather than just adopt it.
3+ years of programming in Python, Ruby, Go, Swift, Java, .Net, C++ or similar object oriented language experience
Bachelor's degree in computer science or equivalent
Knowledge of networking protocols such as HTTP, DNS and TCP/IP
2+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience
Experience with AWS products and services
Experience with programming languages such as Python, Java, C++
Experience building or working with AI/LLM-based agents, automation frameworks, or applying AI to security and operational workflows
Acknowledgement of country
In the spirit of reconciliation Amazon acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today.
IDE statement
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.
