Security Engineer, Security for Employee and Legal Systems

- 2+ years of web protocols, common security attacks, and remediation (non-internship) experience
- Bachelor's degree in Engineering, Computer Science, or a related field
- Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent
- Experience with web protocols, common security attacks, and remediation (non-internship)
- Experience solving basic problems by writing code or scripts with some assistance
- Experience with AWS services or other cloud offerings

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, VA, Arlington - 136,000.00 - 184,000.00 USD annually
Protect the HR and Legal applications millions of Amazonians trust with their most sensitive data. You will join a team that is replacing traditional security reviews with continuous automated evaluation and learning to secure a new generation of GenAI and agentic applications.

Key job responsibilities
● Execute security assessments and code reviews for HR and Legal applications using your team's established processes and tooling, primarily in Java, Python, and JavaScript.
● Contribute to threat models for the applications in your domain, learning to identify the risks that matter most to customers with guidance from senior engineers.
● Help author and refine automated detection rules that catch risks at code commit and give builders clear remediation guidance.
● Support builder teams in adopting secure-by-default infrastructure, learning how paved paths prevent entire categories of issues.
● Investigate security findings, confirm their impact, and work with builders to drive remediation while the code context is fresh.
● Contribute to security automation and tooling that reduces manual effort across the team.
● Document your work clearly so other engineers can understand and build on it.
● Communicate security risk for the problems you work on to your team and direct leadership, in writing and verbally.


A day in the life
On a given day you might review code for a new feature in an HR or Legal application, triage a security finding and walk a builder through the fix, contribute a detection rule that closes a gap the team identified, or pair with a senior engineer to threat model a service that uses GenAI. You will ask a lot of questions, and that is expected. The team values curiosity, clear communication, and a willingness to dig into unfamiliar problems.

About the team
SEALS is a team of security engineers and managers embedded with the development teams that build Amazon's HR and Legal applications. Your colleagues partner directly with builders, reviewing designs and writing detections so security feedback arrives while the code is still fresh. You will collaborate with peer security teams covering finance and communications technology when risks cross domain boundaries. The portfolio is adopting GenAI and agentic capabilities fast, so the security problems are changing in real time. We value clear thinking over heroics, sustainable pace over crunch, and invest equally in technical and management career paths.