We are seeking a Senior Applied Scientist to pioneer the application of artificial intelligence and machine learning to cyber threat intelligence at Amazon scale. In this role, you will invent and deploy novel AI/ML systems that automate threat detection, accelerate intelligence analysis, and enable proactive defense capabilities. You will work on ambiguous, scientifically-complex problems where traditional engineering approaches fall short-from building predictive models that score threat likelihood against Amazon's specific attack surface, to developing graph neural networks that cluster adversary infrastructure, to creating LLM-powered systems that multiply analyst productivity.

This is a unique opportunity to bring scientific rigor to one of the most consequential problem domains in technology-protecting hundreds of millions of customers and the infrastructure that powers the global economy. You will be the first Applied Scientist embedded within ACTI, establishing the science agenda and building the foundation for AI-driven threat intelligence at Amazon.

This position requires that the candidate selected be a US Citizen.

Key job responsibilities

Invent
• Identify, frame, and solve scientifically-complex threat intelligence problems where no textbook solutions exist-including threat scoring, malware classification, infrastructure clustering, and intelligence automation
• Drive the scientific agenda for AI/ML within ACTI by proposing research initiatives, defining success metrics, and securing management buy-in
• Extend and invent machine learning techniques for cybersecurity applications, including anomaly detection on noisy data, few-shot learning for emerging threat families, and graph-based reasoning over attacker infrastructure
• Publish research at peer-reviewed venues (e.g., USENIX Security, IEEE S&P, ACM CCS, NeurIPS workshops)

Implement
• Design, build, and deploy production AI/ML systems that process threat data at scale-from model training on petabyte-scale security logs to real-time inference serving millions of predictions daily
• Partner with ACTI engineering teams to integrate AI/ML models into existing intelligence platforms
• Develop end-to-end solutions including data pipelines, feature engineering, model training, evaluation frameworks, and production monitoring
• Write production-quality code and deploy models with operational excellence-reliability, maintainability, and cost efficiency

Influence
• Influence across multiple ACTI sub-teams and partner organizations
• Build consensus on scientific approaches, balancing analytical rigor with operational urgency inherent to threat intelligence
• Mentor security engineers and analysts on AI/ML concepts, helping the broader ACTI team develop data literacy and scientific thinking
• Represent ACTI in Amazon's internal science community and contribute to the broader information security research ecosystem

About the team

Amazon Cyber Threat Intelligence (ACTI) is responsible for identifying, curating, and reporting timely, accurate, and actionable threat intelligence to protect Amazon's global businesses and customers. We investigate, analyze, and defend against sophisticated cyber threats across all Amazon business lines-AWS, retail, entertainment, logistics, and corporate infrastructure. Our intelligence products serve Amazon and AWS leadership, service teams, partners, and both internal and external customers.

ACTI operates within Amazon's broader security organization led by the Chief Security Officer. We deliver intelligence that enables proactive defense, informs security investment decisions, and supports incident response across the world's largest cloud infrastructure.

BASIC QUALIFICATIONS

- PhD in engineering, technology, computer science, machine learning, robotics, operations research, statistics, mathematics or equivalent quantitative field

- 5+ years of relevant, broad research experience after PhD (or equivalent body of work demonstrating scientific innovation)

- Experience deploying AI/ML models into production systems with direct, verified customer impact

- Experience in one or more: NLP/LLMs, graph neural networks, anomaly detection, deep learning, or probabilistic modeling

- Software development skills

- Publication record (including NeurIPS, ICML, ICLR, ACL, EMNLP, KDD, USENIX Security, IEEE S&P, or equivalent)

PREFERRED QUALIFICATIONS

- Experience applying AI/ML to cybersecurity problems

- Ability to independently frame ambiguous problems, define research agendas, and deliver results with limited guidance

- Familiarity with threat intelligence frameworks and security operations concepts

- Experience with large-scale graph analytics, knowledge graphs, or graph neural networks

- Experience building and deploying LLM/GenAI applications (RAG systems, fine-tuning, prompt engineering at scale)

- Familiarity with ML frameworks such as PyTorch, TensorFlow, or JAX)

- Proficiency with AWS services (SageMaker, Bedrock, EMR, Glue, Lambda, S3)

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, MD, Annapolis Junction - 167,100.00 - 226,100.00 USD annually

USA, NY, New York - 183,800.00 - 248,700.00 USD annually

USA, TX, Austin - 167,100.00 - 226,100.00 USD annually

USA, VA, Arlington - 167,100.00 - 226,100.00 USD annually

USA, WA, Seattle - 167,100.00 - 226,100.00 USD annually