Application Security Engineer, Proactive Security

Application Security Engineer, Proactive Security

Job :  |  Services LLC

The Application Security (App Sec) Security Engineer is responsible for conducting security assessments and reviews of applications and services to identify vulnerabilities and ensure adherence to security standards. This role works under the guidance of senior engineers to evaluate system designs, perform threat modeling, and validate that services meet the organization's security bar before launch.

• Conduct security design reviews for new and existing services, evaluating architecture documents, threat models, and system designs for potential security risks.
• Perform threat modeling exercises to identify attack vectors, security weaknesses, and areas of concern in application architectures.
• Execute or coordinate penetration testing activities to validate security controls and identify exploitable vulnerabilities.
• Document, track, and communicate security findings to service teams, providing clear remediation guidance and verifying fixes.
• Provide security consultation to development teams on secure coding practices, authentication/authorization mechanisms, cryptographic implementations, and data protection strategies.
• Identify and elevate high‑severity security issues through appropriate channels, ensuring timely remediation aligned with launch timelines.
• Maintain clear and thorough documentation of review outcomes, security decisions, and risk assessments.
• Leverage automated security scanning tools and internal security platforms to support review activities and improve efficiency.

• At least 2 years of experience with web protocols, common security attacks, and remediation (non‑internship).
• Bachelor's degree in Engineering, Computer Science, or a related field.
• Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent.
• Experience in application security architecture, security code reviews, security testing, incident response, or security infrastructure.
• Proficiency in coding/scripting in one or more languages (e.g., Python, C, C++, Java, Ruby, or Power Shell).

• Experience with AWS services or other cloud offerings.
• Experience in one or more of the following: application security frameworks, security code reviews, incident response, security infrastructure, penetration testing, mobile security, cloud security, AI security, identity and access controls.
• Knowledge of domains such as web application development, penetration testing, mobile security, cryptography, public key infrastructure, forensic security, IP security, SSL/TLS, computer viruses and malware, network security, trusted security, trusted execution, threat intelligence, IoT security implications, or authentication.
• Experience scripting with Python, Perl, Bash or Power Shell.
• Experience triaging and developing security alerts and response automation, conducting front‑line analysis, and providing escalation support.

Base salary range: $136,000 - $184,000 USD annually.

Amazon is an equal‑opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.