Security Engineer, AWS Security Incident Response

Job description

AWS Security Incident Response is looking for a Security Engineer who investigates with urgency, communicates with clarity, and turns every investigation into an opportunity to make the service smarter. You will perform hands-on security response for customers, work alongside AI-powered investigation agents daily, and feed what you learn back into the automation systems that protect all customers. The AWS Security Incident Response team provides 24/7 security response through a follow-the-sun operating model. The service combines automated triage workflows, AI-powered investigation agents, and human security analysts to respond to threats across customer AWS environments at massive scale. Our AI systems autonomously resolve the majority of routine investigations within minutes. Every engineer on the team is expected to be fluent in how these AI systems work, provide feedback that improves their accuracy, and identify opportunities to extend their capabilities. This is not a traditional security operations role. You will investigate security incidents hands-on, but equally important is what happens after the investigation: documenting patterns, proposing detection rules, providing structured feedback to AI agents, and building the automation that prevents the same issue from requiring human investigation again. We treat every investigation as a confirmed security incident until the data proves otherwise. This…