# Amazon and AWS security engineer interview process, loop and pay

Source: https://www.techinterview.org/post/3233477867/amazon-security-engineer-interview-loop/
Updated: 2026-11-05 · techinterview.org

Amazon's security engineer interview is one or two 60-minute phone screens, then five 60-minute interviews, with the outcome listed as "(within 5 business days)." Amazon names seven technical competencies for those five interviews, and each interviewer typically asks two or three Leadership Principle questions. The two detailed recent candidate accounts describe roughly one technical topic per interview and a scripting task rather than LeetCode; shorter reports show other shapes. Posted US base pay runs from $136,000 (Security Engineer I) to $226,700 (most SE III and Senior postings).

Amazon wrote a [prep page specifically for security engineer candidates](https://amazon.jobs/content/en/how-we-hire/security-engineer-interview-prep). It gives the format, the competencies interviewers are "assigned to evaluate," and four self-check questions that work as a code review rubric. In a November 4, 2026 amazon.jobs search, every AWS and Stores security engineer posting except physical and chip security sat in one job family, Systems Security Engineering, under that page, so an AWS security loop is this loop, team variation aside. The SDE loop is covered in our [Amazon interview guide](/companies/amazon/); other security write-ups are in our [security engineer interview guides](/security-engineer-interview-guides/).

## What Amazon's prep page commits to

The process runs application, phone screen, loop, then "Interview Outcome (within 5 business days)." For new grads, a single [May 2025 Blind post](https://www.teamblind.com/post/amazon-new-grad-security-engineer-2025-passed-interviews-but-got-waitlisted-hwcenyq6) says five of 32 candidates phone-screened in late April were waitlisted, with no offers yet. There are "one to two technical phone screenings," each 60 minutes "with a senior leader on the team," and a screen can include secure code review, security fundamentals and Leadership Principles (LPs). The loop is "five 60-minute interviews where you'll meet with members of our security engineering community," held on Zoom or Amazon Chime. The seven technical competencies:

- Secure code review of a snippet, with mitigations "in and outside of the code"

- Scripting and automation in "your choice of programming language"

- Threat modeling from an architecture diagram

- Security testing, possibly "a live exercise identifying security issues in a given system"

- Web vulnerabilities and mitigations, including your "strategy for exploiting the vulnerability"

- Cryptography, from PKI and TLS to server- versus client-side encryption

- Security fundamentals, including how you'd communicate during "live security events"

Security design sits inside threat modeling, and incident response is only that one line under fundamentals.

## Amazon's four-question secure code review rubric

Under "Sample technical questions," the page lists four self-check questions, the closest thing Amazon publishes to a scoring guide:

> Did you identify most of the vulnerabilities? Did you provide feasible and scalable mitigation strategies? Did you discuss trade-offs for other mitigation considerations and explain why your proposed mitigation fits best? Did you demonstrate a strong understanding of how the code works from a functional perspective?

Amazon's tip is to "Identify as many security vulnerabilities within the code that you can," so rank by severity as you go, without stopping early. The fourth question matters as much: if you can't say what the code does for its users, your severity calls are guesses, so open with Amazon's own question, "What's the business context behind the code?" Our [secure code review interview walkthrough](/post/3233477869/secure-code-review-interview/) ranks the findings for one vulnerable service.

## How recent candidates describe the Amazon loop

The two detailed accounts we found describe roughly one technical topic per interview. A [Blind mega-thread](https://www.teamblind.com/post/lets-make-a-security-engineer-interview-experience-mega-thread-f1ur1j53) dated Sep 21 (no year shown) gives "4-5 rounds depending on the team," each with two LP questions and one of secure code review, cryptography ("tls, mtls, certificate management"), scripting, threat modeling or cloud architecture. A rejected candidate's [August 2025 Medium write-up](https://medium.com/@yuvasurya1998/what-i-learned-from-getting-rejected-by-amazon-a-security-engineers-interview-experience-293e65a2f942) lists five interviews over two days, including Python log parsing, a cloud round and a STRIDE threat model, with no code review round.

Shorter Glassdoor snippets show other shapes: one technical round combining threat modeling and code review, with the rest behavioral ([London AppSec, January 2025](https://www.glassdoor.com/Interview/Amazon-Interview-RVW95422909.htm)), and six rounds with two of code review ([New York SE II, mid-2024](https://www.glassdoor.com/Interview/Amazon-Security-Engineer-II-Interview-Questions-EI_IE6036.0,6_KO7,27.htm)). An [October 2025 Blind poster](https://www.teamblind.com/post/aws-loop-interview-security-engineering-8bmghf51) relayed their recruiter saying "AWS does a 6-hour loop interview process."

### Phone screen topics, including AI security

The mega-thread's phone screen covered OWASP Top 10, input validation versus sanitization, crypto, "[AI security related questions](/post/3233477871/ai-security-interview-questions/) if any," and two "tell me about a time" questions. The Medium candidate's hiring-manager screen covered AppSec topics. AI security also shows up outside the screen: a Kuala Lumpur SE I candidate reported a pre-loop questionnaire in 2024 that included it ([Glassdoor snippet](https://www.glassdoor.com/Interview/Amazon-Security-Engineer-I-Interview-Questions-EI_IE6036.0,6_KO7,26.htm)), and amazon.jobs carries dedicated AI Security postings.

### Scripting, and thin evidence of more coding at AWS

Neither detailed account had a LeetCode round. The mega-thread calls the coding "mostly not leet code… write a small script to parse certain data from a file." Only one comment is about AWS: a 2021 note from [someone who interviewed there](https://www.teamblind.com/post/amazon-security-engineering-interview-51bpvjr5) ("I had to write code"). Another 2021 comment cites ["one round of Algorithm / problem solving"](https://www.teamblind.com/post/Amazon-security-engineer-loop-interview-questions-cTw7h1vA) for an unnamed team. That's thin, but a few evenings on the [common coding patterns](/algorithm-patterns-cheat-sheet/) is cheap insurance.

## Threat modeling prompts candidates report in Amazon loops

Amazon says to expect "an architecture diagram to identify threats and attack patterns," mitigations tied to "business requirements," and possibly a request to "build test cases and plans." Reported prompts:

- a vending machine (Blind mega-thread)

- "design a cloud native book store and identify risks," in a cloud architecture round (same thread)

- a login page, CDN, app servers, Kubernetes, APIs and a database, walked through with STRIDE (Medium, August 2025)

- a smart-home security system (Glassdoor, London AppSec, January 2025, snippet only)

- a parking garage, for an internship ([Medium, undated](https://medium.com/@rohitreturns00/my-amazon-security-engineering-internship-interview-experience-674f53de0072), snippet only)

AWS's [2021 threat modeling post](https://aws.amazon.com/blogs/security/how-to-approach-threat-modeling/), which describes AWS practice rather than the rubric, starts from "assets, actors, entry points, components, use cases, and trust levels," then STRIDE and risk ranking, a sensible order to say out loud. Our [threat modeling interview walkthrough](/post/3233477868/threat-modeling-interview/) has a full STRIDE table with trust boundaries; the bookstore prompt is closer to a [security system design interview](/post/3233477870/security-system-design-interview/), where you design and defend in the same hour.

## Two or three Leadership Principle questions from every interviewer

Amazon says "a significant portion" of the conversation covers its [Leadership Principles](/post/3233474665/amazon-leadership-principles-cheat-sheet/) and that "each interviewer will typically ask two or three behavioral-based questions." It gives no weighting for individual principles, and the behavioral text matches the [SDE II page](https://amazon.jobs/content/en/how-we-hire/sde-ii-interview-prep) word for word, so it's Amazon-wide guidance. Its advice is STAR, data in the result, and "'I' is better than 'we.'" In a linked video, Bar Raiser Florian adds "level appropriate examples" and "bring home the result."

At the mega-thread's low end, four rounds of two LP questions make 8; Amazon's five interviewers asking up to three make 15. Plan for 8 to 15 distinct stories. The mega-thread advises "Try not to repeat your stories, that shows lack of experience according to some." A 2025 [r/cybersecurity reply](https://www.reddit.com/r/cybersecurity/comments/1sg1xtp/umpcooming_security_engineer_interview_at_amazon/), prep advice rather than a loop account, suggests "at least 3 stories in STAR format for each domain," meaning each technical topic, such as code review or threat modeling. The Medium candidate was asked about influencing developers to adopt security practices and handling conflicting priorities, both good security-story templates.

## The Bar Raiser, according to Amazon

Amazon's [Bar Raiser page](https://www.aboutamazon.com/news/workplace/amazon-bar-raiser) calls them "objective third-party advisers." The Bar Raiser, "with hiring manager, makes final hiring decision," and the program "avoids having one person make the hiring decision." None of the Amazon pages we read says one sits on every security loop or mentions a veto. The mega-thread says "There could be a bar riser round," possibly LP-only.

## Which security team you're interviewing with

The prep page asks only for "depth of technical knowledge as it relates to your specialty," but the teams differ:

- Application security, such as [Stores AppSec](https://www.amazon.jobs/en/jobs/10541158) ("attack Amazon's services, applications, and websites") and AWS Security's application security engineers.

- The AWS Proactive Security Team, posting at SE I, II and III.

- Incident response, including SIRT, AWS Security Incident Response and AWS Cloud Security Response.

### An incident response prep path, by inference

The Medium cloud round asked which logs to correlate in an investigation and about suspicious authentication in CloudTrail and Cognito. A May 2025 Arlington review describes "scenario-based" incident response questions ([Glassdoor snippet](https://www.glassdoor.com/Interview/Amazon-Security-Engineer-Interview-Questions-EI_IE6036.0,6_KO7,24.htm)). The [Senior Security Engineer, AWS Security posting](https://www.amazon.jobs/en/jobs/10594433) asks for 5+ years of investigations, detection engineering, threat hunting or incident response, plus knowledge of attacker TTPs and host and network telemetry such as process lists and NetFlow. An SE II [SIRT posting](https://www.amazon.jobs/en/jobs/10586928) values "forensics, malware analysis… threat hunting, and threat intelligence." Practice walking one alert from the first log line to containment and the update you'd send stakeholders.

## Posted base pay by Amazon security engineer title

Amazon's US postings show base ranges, and packages add "sign-on payments and restricted stock units (RSUs)."

| Amazon security engineer title (US postings, fetched Nov 4, 2026) | Posted US base salary range | Postings counted | Basic qualification, as posted |
| --- | --- | --- | --- |
| Security Engineer I | $136,000–$184,000 | 4 | 2+ years of web protocols, attacks and remediation; scripts "with some assistance" |
| Security Engineer II | $159,300–$202,400 in most; some to $212,800 | 33 | 2+ years of scripting, programming and security code review |
| Security Engineer III | $178,400–$226,700 | 2 | 4+ years of scripting and code review; 5+ years identifying risks; mentor or tech lead |
| Senior Security Engineer | Mostly $178,400–$226,700; a few to $247,600 | 29 | AWS Security example: mentor, tech lead or led a team; 5+ years of investigations, detection, threat hunting or incident response |

SE III and Senior share a main band and both ask for mentor or tech-lead experience, so senior-level stories should show you improving other engineers' security work. [Levels.fyi](https://www.levels.fyi/companies/amazon/salaries/security-engineer)'s 63 submissions put [total comp](/total-comp-calculator/) near $189,000 at L4, $280,000 at L5, $379,000 at L6 and $488,000 at L7. The SE I through III to L4 through L6 mapping is community convention; Amazon doesn't state it.

## Where to put your prep hours

Start with secure code review, which Amazon lists for the screen as well as the loop. Next, threat model three shapes on a timer (a physical object, a cloud web stack, a system you've built) and end each with test cases. Then script: parse a messy log, handle malformed lines, and explain what breaks at 100 times the input.

For web vulnerabilities, be ready to say how you'd exploit each class as well as fix it, and for security testing, how you'd run a live exercise against a sample system. Refresh IAM, CloudTrail and stolen instance credentials (our [SSRF and cloud metadata write-up](/post/3233477308/ssrf-cloud-metadata-interview/) covers the last), and know the [TLS handshake](/post/3233477262/tls-handshake-interview/) well enough to say where mTLS changes it. Spend the rest on stories; the [STAR answer builder](/star-method-answer-builder/) helps.

## What we couldn't confirm

- How the seven competencies map onto five interviewers, or whether every loop covers all seven.

- A Bar Raiser on every security loop, or a veto. The one veto claim we traced was in a file Amazon's page labels "Bar Raiser: Anna," which holds the transcript of a third-party video about TPM interviews.

- A standalone incident response round, or how SIRT and Cloud Security Response loops run.

- The mega-thread's year, and the SE-to-L-level mapping.

- Full Glassdoor and internship texts, which blocked us; we cite snippets. Our search also ended early when its budget ran out, and the Reddit threads we found were prep questions, not loop accounts.

Amazon's page says interviewers are "assigned" to competencies, so ask your recruiter which ones your five interviewers own. Not every recruiter will say, but a yes turns seven prep areas into five.