Security Engineer II, AWS Security Corporate Response

Amazon is hiring a Security Engineer II, AWS Security Corporate Response in Melbourne, Australia. Level rates it ; you can apply on Level.

Level's read on this job

Level rates this cybersecurity role Little AI ●○○○: aI is not part of the work.
The posting mentions AI agents and AI automation among its tools and skills.
Level classes it as a mid-level role.
Amazon has 22,000+ other open roles on Level.
This posting went up in the last few days.

AI in this role

ai-agentsai-automation

AWS Corporate Security Response is looking for a Security Engineer who thrives at the intersection of hands-on incident response and intelligent automation. You must think like both an attacker and a defender — understanding adversary tradecraft to detect, investigate, and disrupt threats across Amazon's corporate infrastructure at massive scale.

You'll investigate active threats — malware campaigns, phishing attacks, credential compromise, and novel attack patterns — while simultaneously shaping an agentic investigation platform that scales our response capability beyond what any human team could achieve alone.

You will independently lead security investigations from detection through containment and remediation. You'll extract IOCs, perform host forensics, scope impact across multiple data sources, check for lateral movement, and drive security issues to resolution — documenting every step as the investigation unfolds. You'll also serve as a demanding customer and quality owner of our AI-powered investigation platform, authoring the investigation user stories that define how autonomous agents analyze threats, designing the guardrails that keep them safe, and validating that automated output meets the same standard a skilled human investigator would produce.

When you identify gaps in our capabilities, you won't wait — you'll quickly design and build tooling that enables programmatic automation at scale, then feed those patterns into the next generation of autonomous investigation.

Key job responsibilities
* Lead Sev2 security investigations end-to-end: acknowledge, investigate with depth (not speed), document as you go, and own through resolution
* Triage Sev2 candidates — promote decisively when indicators are clear, downgrade with documented rationale when they're not
* Analyze open source threat intelligence — these reports contain temporal IOCs that decay with age, making rapid validation and proactive blocking critical
* Author and validate agent investigation user stories, ensuring autonomous investigations match human-quality rigor
* Design and test guardrails and policies — think about how attackers would evade detection, how edge cases produce incorrect results, and how agents might fail in ways developers didn't anticipate
* Build tactical scripts, detection rules, and response automations that address immediate operational gaps — then drive their transition into scalable agentic capabilities
* Participate in a global on-call rotation: own the queue for your shift, monitor operational health, and maintain readiness
* Execute clean shift handoffs: document active investigations, flag anomalies observed during your shift, and explicitly transfer ticket ownership

About the team
CorpSec Response operates 24/7 as a global, follow-the-sun team protecting Amazon's corporate infrastructure. We combine deep human expertise with leading autonomous investigation capabilities. Our engineers are hands-on investigators who also shape the AI systems that augment their work — creating a unique feedback loop between human security expertise and machine-scale automation.

Inclusive Team Culture
We are committed to building a diverse and inclusive team. Amazon's culture of inclusion is reinforced within our Leadership Principles, which remind team members to seek diverse perspectives, learn and be curious, and earn trust.

Work-Life Balance
We value sustainable performance. Our follow-the-sun model means you're not carrying a pager 24/7 — your node owns its shift, and clean handoffs are a core operational discipline.

Growth and Impact
This role offers a rare combination: hands-on technical security work at massive scale, leadership of a high-performing team, and direct influence over an AI-augmented security platform. You'll grow as both a security practitioner and a technical leader.

Basic qualifications

- Bachelor's degree in computer science or equivalent, or experience in IT Security
- Experience in security operations, incident response, or security engineering
- Hands-on experience investigating security incidents (malware analysis, phishing response, credential compromise, or network intrusion)
- Proficiency in Python or similar scripting language for security automation and tooling
- Experience with log analysis platforms (Splunk, ELK, or equivalent) and EDR tools (CrowdStrike, Carbon Black, or equivalent)
- Knowledge of networking protocols (HTTP, DNS, TCP/IP) and operating system internals (Windows and Linux)

Preferred qualifications

- Experience performing detection engineering in a dedicated or hybrid capacity supporting incident response and threat intelligence operations
- Experience designing or validating AI/LLM-powered automation in a security context
- Proficiency in at least one specialization domain: Malware Analysis / Reverse Engineering; Digital Forensics; Security Tool Development & Automation; Network & OS Security; Identity Management
- Experience with threat intelligence platforms and IOC enrichment (VirusTotal, MITRE ATT&CK framework)
- Experience writing detection rules (YARA, Sigma, or custom)
- Experience with Amazon Web Services and cloud security
- Track record of building security automation that measurably reduced manual operational burden
- Security certifications (GCIH, GCFA, GREM, OSCP, or equivalent) are a plus but not required

Acknowledgement of country:
In the spirit of reconciliation Amazon acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today.

IDE statement:
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

How we rate this

Security Engineer II, AWS Security Corporate Response at Amazon rates 28 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Open the description and count.

Key facts

Security Engineer II, AWS Security Corporate Response is an open job at Amazon.
Level rates this role AI Level 1 of 4: Little AI.
The role is based in AU, VIC, Melbourne.
The job was posted on October 19, 2026.
Seniority: mid.
Applications are handled by Amazon. Apply on Amazon

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

AI agentsAI Automation

Also common in cybersecurity jobs at this level

Azure Google Cloud Kubernetes Terraform C++Java

Pay

Typical cybersecurity job: $159k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

How do you decide when an AI agent can act on its own versus asking for approval first?
Tell me about a workflow you automated with AI tools, end to end.

Adapt your resume

List these exact terms on your resume: AI agents and AI Automation. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.

Want an expert to read your CV for this job?

Free. Send your CV and the role you want next. We reply by email within 2 to 4 business days.

Get a free CV review Check your resume with the ATS resume checker