Key job responsibilities
Lead High Severity security investigations end-to-end: acknowledge, investigate with depth (not speed), document as you go, and own through resolution
Triage High Severity candidates — promote decisively when indicators are clear, downgrade with documented rationale when they're not
Analyze open source threat intelligence — these reports contain temporal IOCs that decay with age, making rapid validation and proactive blocking critical
Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor
Design and test guardrails and policies — think about how attackers would evade detection, how edge cases produce incorrect results, and how agents might fail in ways developers didn't anticipate
Build tactical scripts, detection rules, and response automations that address immediate operational gaps — then drive their transition into scalable agentic capabilities
Participate in a global on-call rotation: own the queue for your shift, monitor operational health, and maintain readiness
Execute clean shift handoffs: document active investigations, flag anomalies observed during your shift, and explicitly transfer ticket ownership
About the team
CorpSec Response operates 24/7 as a global, follow-the-sun team protecting Amazon's corporate infrastructure. We combine deep human expertise with leading autonomous investigation capabilities. Our engineers are hands-on investigators who also shape the AI systems that augment their work — creating a unique feedback loop between human security expertise and machine-scale automation.
Inclusive Team Culture
We are committed to building a diverse and inclusive team. Amazon's culture of inclusion is reinforced within our Leadership Principles, which remind team members to seek diverse perspectives, learn and be curious, and earn trust.
Work-Life Balance
We value sustainable performance. Our follow-the-sun model means you're not carrying a pager 24/7 — your node owns its shift, and clean handoffs are a core operational discipline.
Growth and Impact
This role offers a rare combination: hands-on technical security work at massive scale, leadership of a high-performing team, and direct influence over an AI-augmented security platform. You'll grow as both a security practitioner and a technical leader.
Bachelor's degree in computer science or equivalent, or experience in IT Security
Experience in security operations, incident response, or security engineering
Hands-on experience investigating security incidents (malware analysis, phishing response, credential compromise, or network intrusion)
Proficiency in Python or similar scripting language for security automation and tooling
Experience with log analysis platforms (Splunk, ELK, or equivalent) and EDR tools (CrowdStrike, Carbon Black, or equivalent)
Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux)
Experience performing detection engineering in a dedicated or hybrid capacity supporting incident response and threat intelligence operations
Experience designing or validating AI/LLM-powered automation in a security context
Proficiency in at least one specialization domain: Malware Analysis / Reverse Engineering; Digital Forensics; Security Tool Development & Automation; Network & OS Security; Identity Management
Experience with threat intelligence platforms and IOC enrichment (VirusTotal, MITRE ATT&CK framework)
Track record of building security automation that measurably reduced manual operational burden
Security certifications (GCIH, GCFA, GREM, OSCP, or equivalent) are a plus but not required
Acknowledgement of country
In the spirit of reconciliation Amazon acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today.
IDE statement
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.
