Amazon
Security Engineer II, Stores AppSec
$159K–$213K
New York, NY · Full-time · Posted Sep 15, 2026
- Experience
- 3+ years of programming experience; 2+ years each in scripting/programming/security code review and systems troubleshooting/log analysis/automation (non-internship); bachelor's degree in STEM or 2+ years of IT Security experience.
- Education
- Bachelor's degree in a STEM field (Science, Technology, Engineering, Mathematics), or 2+ years of IT Security experience.
About the job
Conducts application security reviews and penetration tests of Amazon services, applications, and websites, then documents findings and works with teams to resolve them.
What you'll do
- Conduct application security reviews and penetration tests independently or with a team.
- Create engagement plans and document findings, security gaps, and remediation recommendations.
- Collaborate with partner teams, service owners, Information Security, and leadership to prioritize and resolve findings; contribute to team tooling and improvements.
What they ask for
- 3+ years of programming experience in Python, Ruby, Go, Swift, Java, .Net, C++ or a similar object-oriented language.
- 2+ years of non-internship experience in scripting, programming, and security code review in a common programming language.
- 2+ years of non-internship experience troubleshooting systems issues, analyzing logs, or automating basic tasks with command line tools.
- Bachelor's degree in a STEM field, or 2+ years of IT Security experience; knowledge of networking protocols and security vulnerabilities and remediation techniques.
Nice to have
- 2+ years in any combination of threat modeling, secure coding, identity management and authentication, software development, cryptography, system administration, or network security.
- Experience with AWS products and services or security activities across phases of the software development lifecycle.
Pay
159,300.00 - 212,800.00 USD annually (base salary)
Tools
Python, Ruby, Go, Swift, Java, .Net, C++, AWS
Model-written summary · the original posting is authoritative