Senior Software Engineer, AppSTAR COMPASS

Be a founding engineer on a brand-new team building security review for the LLM age. You'll design and write the platform that evaluates every code change tens of thousands of engineers ship, and clears the vast majority without a human ever touching it. Security review has always been a bottleneck. A developer ships a change, waits for someone to look at it, and the security team drowns in a queue it can never fully clear. We're ending that tradeoff. Our engine evaluates changes as they happen, decides how much scrutiny each one actually needs, and handles the common case automatically with no wait for the developer and no queue for the reviewer. The team is funded and forming now, and the first engineers will set the architecture. That means real design ownership, not a codebase you inherit, and experienced security engineers backing you with the risk expertise so you build against what actually matters. If you want to work on agentic systems where the correctness bar is high and the impact is measurable, this is the seat. Set the architecture for a greenfield platform, not maintain someone else's Build agentic and automated evaluation running continuously at very high volume Ship something measurable: fewer manual reviews, faster releases, no added burden on developers Key job responsibilities - Design and build the core of an event-driven platform that evaluates code changes for security risk, routes the small fraction needing human attention, and clears the rest automatically. - Own significant technical decisions end to end: data flow, evaluation pipeline, service boundaries, storage, and the tradeoffs behind each one. - Build and tune the automated evaluation layers, including agentic checks, and the mechanisms that keep their decisions accurate over time. - Partner closely with the security team that defines how risk is evaluated, turning their criteria into production code that runs reliably at scale. - Work directly with the security engineers who handle escalated changes, building the queues, context, and tooling that make their reviews fast. - Build the developer-facing experience: clear, trustworthy visibility into what was evaluated, what happened, and why, with as close to zero required action as possible. - Negotiate and implement the integrations with adjacent platform and telemetry teams the system depends on. - Raise the engineering bar on a new team: code review, design review, testing strategy, operational readiness, and on-call fundamentals from the start. - Mentor engineers and help interview and grow the team as it scales. A day in the life You'll spend most of your time designing and writing code on a system that doesn't exist yet: how an event moves through the pipeline, where automated checks fire, what happens when confidence drops. You'll pair with security engineers to pressure-test whether your evaluation logic catches what it should. Some days you're in a design review defending a boundary decision, or debugging why a class of change is getting routed wrong at volume. Early on you'll help shape the roadmap and interview the engineers who join next.

We decide how security attention gets spent. Our customers are the engineers shipping code every day and the security engineers reviewing it, and both are paying a tax we think is unnecessary. Our mission is to remove it: make security assurance automatic, proportional to real risk, and visible to the people it protects. We're small, new, and unusually close to the outcome. We care more about getting the decision right than about being the ones who make it, and we'd rather encode expertise into a mechanism than hoard it. Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop