Applied Scientist II, Identity Security & Abuse Prevention

Amazon's Identity Security & Abuse Prevention (ISAP) team is seeking an Applied Scientist to join our team. We discover, analyze, and quantify security risks across Amazon's identity and authentication landscape, transforming complex behavioral patterns into actionable intelligence that empowers teams to proactively defend against abuse and unauthorized access. In this role, you will design, build, and own machine learning systems that detect abuse patterns, classify threats, and automate enforcement across sensitive datasets spanning multiple Amazon verticals. You will independently frame ambiguous detection problems, develop novel approaches to abuse prevention, and deploy production ML systems that directly protect Amazon customers and sellers at scale. You will work at the intersection of applied science and security operations, translating complex abuse vectors into scalable detection capabilities. This is a high-ownership role where your models and systems run autonomously in production, making real-time decisions that prevent fraud and abuse. You will own both existing detection capabilities (improving precision, recall, and coverage of current models) and greenfield science (designing and deploying new detection systems for emerging threat vectors). You will lead experimental design, extend or invent methodologies for your domain, mentor junior scientists, and contribute to the team's scientific roadmap. You will partner with investigators, security engineers, and data engineers to build end-to-end detection and enforcement pipelines, and you will leverage GenAI, LLMs, and AI-agent architectures to advance our abuse prevention capabilities. Key job responsibilities - Design, develop, and deploy production ML systems for abuse pattern detection, anomaly detection, threat classification, and automated enforcement across multiple Amazon verticals - Independently frame ambiguous security and abuse problems into well-defined scientific questions, propose detection approaches, and drive them from hypothesis through production deployment - Own and improve existing detection models end-to-end: monitor for drift, diagnose degradation, retrain, and extend coverage as abuse patterns evolve - Build and maintain graph-based entity analysis, identity resolution, and modus operandi classification systems that link bad actors across accounts, devices, and behavioral signals - Design and execute rigorous experiments (A/B testing, offline evaluation, statistical validation) to measure model performance and quantify business impact - Architect and deploy GenAI and LLM-based solutions for investigation automation, case classification, and intelligent knowledge retrieval - Contribute to the team's scientific roadmap by identifying high-value detection opportunities, proposing new approaches, and driving prioritization of science investments - Publish research findings in internal Amazon papers and at external peer-reviewed conferences; contribute to the broader scientific community - Partner with investigators, security engineers, and data engineers to understand abuse patterns, translate operational insights into model features, and ensure detection systems drive real enforcement actions A day in the life Your morning might start with reviewing model performance dashboards for a classifier you deployed last month, noticing a subtle precision drop that suggests adversarial adaptation. You diagnose the drift, propose a feature addition to counter the new pattern, and kick off a retraining job. Mid-morning, you lead a design review on a new graph-based detection approach you developed to identify organized abuse rings operating across multiple verticals. After lunch, an investigator shares a newly identified modus operandi, and you explore the data to determine if the pattern is learnable at scale, sketching an experimental design. Late afternoon, you pair with a junior scientist on their anomaly detection model, helping them refine their