Security Engineer, Compliance Penetration Testing

Responsibilities

• Conduct high-quality penetration tests independently or as part of a team.
• Create engagement plans and document vulnerabilities, gaps, remediation recommendations, severity, and supporting evidence.
• Manually identify, exploit, and document application vulnerabilities across authentication, authorization, business logic, and input validation.
• Contribute to security testing tooling, automation, innovation, and process improvements.
• Collaborate with partner teams, service owners, Information Security, software development teams, and senior leadership to prioritize and resolve findings.
• Write penetration-test reports and communicate findings, severity, and remediation guidance.

Requirements

• Bachelor’s degree in a STEM field or experience in IT Security.
• At least 2 years of scripting-language experience or at least 2 years of non-internship professional software development experience.
• Knowledge of networking protocols including DNS, and TCP/IP.
• At least 3 years of non-internship hands-on application penetration testing or offensive security assessment experience across web applications, APIs, or cloud services.
• Experience writing penetration-test reports and communicating findings directly to software development teams.
• Preferred: experience with security activities such as security design review, threat modeling, secure code review, and security testing.
• Preferred: experience with AWS products and services, service-oriented or RPC-based backend services, security automation, and AI or LLM-assisted security testing.
• Preferred: working knowledge of PCI DSS, SOX, MAS TRM, RBI, or GDPR and recognized testing standards including OWASP ASVS, OWASP Top 10, or PTES.
• Preferred: offensive-security certification such as OSCP, OSWE, GPEN, or PenTest+.

Benefits

• Flexible work hours and arrangements.
• Health insurance including medical, dental, vision, prescription, Basic Life & AD&D insurance, supplemental life-plan options, EAP, mental-health support, a medical advice line, flexible spending accounts, and adoption and surrogacy reimbursement.
• 401(k) matching, paid time off, and parental leave.
• Training, knowledge-sharing, and career-development resources.
• Sign-on payments and restricted stock units are included in the Amazon package.