Forensic Security Engineer III, ITI Forensics

Amazon Security is hiring a senior Security Engineer to take on our hardest digital forensic investigations and build the tools that make them faster and easier. This is a senior forensics role: you set technical direction, solve cases no one else can, and raise the bar for the whole team.

You will:

• Run complex insider-threat and misconduct investigations end to end -- consult, acquire forensically sound data, and analyze it.
• Guide other engineers through their hardest cases and sharpen how the team works.
• Partner with customers across Amazon Security and Legal, build trust, and turn that trust into new work.
• Design and ship forensic tooling in Python and AWS CDK that unlocks new data sources and scales to meet the demands of Amazon's ecosystem.

We invent new ways to do forensic acquisition and processing in a remote, cloud-first world -- all on AWS.

Key job responsibilities

• Lead the toughest digital forensic investigations end to end: customer consultation, forensically sound acquisition, and analysis across laptops, mobile devices, AWS cloud resources, and large log sets.
• Drive technical direction for how the team runs investigations, and raise the bar on quality, soundness, and speed.
• Mentor and unblock other engineers on their investigations
• Build strong customer relationships across Amazon Security and Legal, scope the right data to answer the right question, and grow new casework from that trust.
• Own forensic engineering projects from idea to production -- improving, scaling, or unlocking new acquisition and processing methods, mostly in Python and AWS CDK.
• Use code and AI to deliver results to customers faster, and improve security where it applies.
• Share on-call duty for our fault-tolerant systems and active security threats, rotating one week at a time, and fix root causes so the same page never happens twice.

A day in the life Most days you are deep in a case. You might scope a new investigation with a customer in the morning, acquire forensically sound data from a laptop or AWS account, then analyze it and build the report that answers their question. No two cases are the same, so you design the collection and the reporting to fit.

Between cases you build. You write Python and AWS CDK tooling that collects new data sources, processes evidence at scale, and automates quality checks on results.

Your customers are internal: Amazon Security and Legal teams running insider-threat, misconduct, and e-Discovery investigations.

About the team We are ITI Forensics, based in the DMV and Seattle. We do forensic data acquisition and analysis for customers across Amazon, and support e-Discovery for Legal.

We work collaboratively, both on cases and on the tools we build to collect new data sources, process evidence at scale, and automate quality checks. Most cases are unique and call for bespoke collection and reporting, so we invent new ways to do forensic acquisition and processing in a remote world.

Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying.

Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores.

Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices.

Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional.

Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic qualifications

• 4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience
• 4+ years of work in identifying security issues and risks, and developing mitigation plans experience
• 2+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
• Experience as a mentor, tech lead or leading an engineering team Preferred qualifications
• Master's degree in Computer Science or a related field
• Experience applying threat modeling or other risk identification techniques or equivalent
• Experience with security in service-oriented architectures/microservices and web services

Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, MD, Annapolis Junction - 178,400.00 - 226,700.00 USD annually USA, VA, Arlington - 178,400.00 - 226,700.00 USD annually USA, VA, Herndon - 178,400.00 - 226,700.00 USD annually USA, WA, Seattle - 178,400.00 - 226,700.00 USD annually