Security Engineer II, AWS Security Incident Response

Amazon is hiring a Security Engineer II, AWS Security Incident Response in Manchester, United Kingdom. Level rates it ; you can apply on Amazon.

Level's read on this job

Little AI ●○○○ is how Level rates this cybersecurity role: aI is not part of the work.
The posting mentions Amazon Guardduty, Crowdstrike Falcon and Wiz among its tools and skills.
Level classes it as a mid-level role.
Amazon has 21,000+ other open roles on Level.
Posted in the last few days.

AI in this role

Respond to security incidents, monitor networks for potential threats, and develop security automation for AWS.

amazon-guarddutycrowdstrike-falconwiz

incident-responsethreat-detectionsecurity-automationvulnerability-assessment

AWS Applied AI Solutions (AAIS) is building toward a future where every business innovates with Amazon AI teammates. To get there, we build AI solutions that improve human capabilities and transform entire business functions. We create end-to-end products that surprise and delight out-of-the-box, making complex things easy and hard things possible, with no cloud experience required. We start with customers who embrace the future and build bridges to meet the rest where they are. We pursue ambitious opportunities with conviction, and we are looking for builders who share that mindset.

AWS Security Incident Response is looking for technical Security Engineers that are passionate about learning new concepts and work well within a team environment to keep customers secure. We value engineers that can work through ambiguity to identify suspicious activity, lead security response, and can explain technical security concepts to non-technical audiences.

Key job responsibilities
• Respond to threat findings that indicate unauthorized activity has occurred
• Identify, evaluate, and communicate security threats risks and vulnerabilities and propose recommended remediation for security issues.
• Contribute to the development of security automation and security posture improvements.
• Track and report on the effectiveness of AWS detective controls such as Amazon GuardDuty and partner products such as CrowdStrike Falcon or Wiz Defend
• Develop processes and policies to increase security response effectiveness.
• On-call support: This role requires periodic on-call responsibilities including weekends.
• Hold or be able to obtain and maintain a UK Government Security Clearance - https://www.gov.uk/government/publications/united-kingdom-security-vetting-clearance-levels.

A day in the life
As a Security Engineer in AWS Security Incident Response your responsibilities include monitoring networks and systems for potential threats performing triage for security alerts documenting suspicious activity and reporting issues so they can be adequately handled. You will work alongside our security engineers and partner teams to perform daily threat detection and incident response using the full capability of AWS technologies and services to detect and mitigate cyber threats at a massive scale and help protect AWS Customers. You should also enjoy learning about the most up-to-date new technologies and procedures to protect information systems and data.

About the team
Amazon values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn't followed a traditional path, or includes alternative experiences, don't let it stop you from applying.

Amazon Web Services (AWS) is the world's most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that's why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses.

We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there's nothing we can't achieve in the cloud.

Here at AWS, it's in our nature to learn and be curious. Our employee-led affinity groups foster a culture of inclusion that empower us to be proud of our differences. Ongoing events and learning experiences, including our Conversations on Race and Ethnicity and AmazeCon conferences, inspire us to never stop embracing our uniqueness.

We're continuously raising our performance bar as we strive to become Earth's Best Employer. That's why you'll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional.

Basic qualifications

- Bachelor's degree in computer science or equivalent
- Knowledge of networking protocols such as HTTP, DNS and TCP/IP
- Knowledge of industry-based security vulnerabilities and remediation techniques
- Experience in scripting, programming, and security code reviewing in a common programming language (non-internship)
- Experience in troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship experience)
- 3+ years of programming in Python, Ruby, Go, Swift, Java, .Net, C++ or similar object oriented language experience
- 3+ years of scripting, programming, and security code review in a common programming language (non-internship) experience
- 3+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship) experience

Preferred qualifications

- Experience with AWS services or other cloud offerings
- Experience triaging security alerts, front-line analysis, and escalation
- GCIH (GIAC Certified Incident Handler) or GSEC (GIAC Security Essentials) or Security+, or CISSP, CISA, CISM or other security certification
- Experience with AI/ML technologies
- Knowledge of system security vulnerabilities and remediation techniques, including penetration testing and the development of exploits or equivalent

Amazon is an equal opportunities employer. We believe passionately that employing a diverse workforce is central to our success. We make recruiting decisions based on your experience and skills. We value your passion to discover, invent, simplify and build. Protecting your privacy and the security of your data is a longstanding top priority for Amazon. Please consult our Privacy Notice (https://www.amazon.jobs/en/privacy_page) to know more about how we collect, use and transfer the personal data of our candidates.

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

How we rate this

Security Engineer II, AWS Security Incident Response at Amazon rates 10 out of 100 for how much of the daily work is AI. That makes it Little AI (AI Level 1 of 4). The level is about AI in the job, not seniority.

Classification

Little AI. AI is not part of the work.

●●●● Builds AI80 to 100
●●●○ Works on AI60 to 79
●●○○ Uses AI40 to 59
●○○○ Little AI0 to 39

Levels come from how often the tools, models and workflows of the role are named in the posting itself. Read the description and count the AI tools, models and workflows it names.

Key facts

Security Engineer II, AWS Security Incident Response is an open job at Amazon.
Level rates this role AI Level 1 of 4: Little AI.
The role is based in GB, Manchester.
The job was posted on October 27, 2026.
Seniority: mid.
Applications are handled by Amazon. Apply on Amazon

Prepare for this job

Built from this posting and from similar jobs on Level.

Skills and AI tools this role asks for

Incident ResponseThreat DetectionSecurity AutomationVulnerability AssessmentAmazon GuarddutyCrowdstrike FalconWiz

Also common in cybersecurity jobs at this level

Azure Google Cloud Kubernetes Terraform AI agents LLM

Pay

Typical cybersecurity job: $159k

This posting doesn't list pay. Use the typical cybersecurity figure when pay comes up. See cybersecurity jobs

Questions you could be asked

Tell me about a project where incident response was part of your work. What did you do?
Tell me about a project where threat detection was part of your work. What did you do?
Tell me about a project where security automation was part of your work. What did you do?
Tell me about a project where vulnerability assessment was part of your work. What did you do?
Walk me through how you've used Amazon Guardduty in your day-to-day work.

Adapt your resume

List these exact terms on your resume: Incident Response, Threat Detection, Security Automation, Vulnerability Assessment, and Amazon Guardduty. An applicant tracking system matches the wording, not the idea.
Attach one line of real, concrete experience to at least one of them. A tool named with nothing behind it rarely survives a human read.

Want an expert to read your CV for this job?

Free. Send your CV and the role you want next. We reply by email within 2 to 4 business days.

Get a free CV review Get your CV rewritten Check your resume with the ATS resume checker