Application Security Engineer, Proactive Security

Amazon.com Services LLC is seeking an Application Security Engineer focused on proactive AppSec for applications and services in the Seattle, WA area. In this onsite role, you will help assess service readiness by identifying vulnerabilities, reviewing designs against security expectations, and ensuring teams can launch with confidence.

You will work under the guidance of senior engineers to evaluate system designs, conduct threat modeling, and validate that services meet the organization’s security bar before release. The position combines hands-on security validation with clear communication of findings so development teams can remediate issues effectively.

Security assessment and design review

• Conduct security design reviews for both new and existing services, evaluating architecture documents, threat models, and system designs for potential security risks
• Maintain clear and thorough documentation of review outcomes, security decisions, and risk assessments
• Leverage automated security scanning tools and internal security platforms to support review activities and improve efficiency

Threat modeling and validation

• Perform threat modeling exercises to identify attack vectors, security weaknesses, and areas of concern in application architectures
• Execute or coordinate penetration testing activities to validate security controls and identify exploitable vulnerabilities

Reporting and secure guidance

• Document, track, and communicate security findings to service teams, providing clear remediation guidance and verifying fixes
• Provide security consultation to development teams on secure coding practices, authentication and authorization mechanisms, cryptographic implementations, and data protection strategies
• Identify and escalate high-severity security issues through appropriate channels, ensuring timely remediation aligned with launch timelines

Minimum qualifications

• 2+ years of web protocols, common security attacks, and remediation experience (non-internship)
• Bachelor’s degree in Engineering, Computer Science, or a related field
• Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent
• Experience solving basic problems by writing code or scripts with some assistance
• Experience with AWS services or other cloud offerings

Work location

• Seattle, WA (onsite)

Compensation

• USD 136,000 - 184,000 per year

Technology focus

• AWS

Benefits

• Sign-on payments
• Restricted stock units (RSUs)
• Health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage)
• 401(k) matching
• Paid time off
• Parental leave