Principal Software Development Engineer

About the role

Amazon S3 holds the world's data. Customers of every size build on it because it gives them durability, scale, and control they can rely on, and because the controls around their data are as much a part of the product as the storage itself. Every request to S3 carries an authorization decision, made in line, at S3's request rate, within a latency budget measured in a small fraction of the request. That combination of scale, precision, and speed makes security in S3 one of the most interesting distributed systems problems at AWS.

We are building S3 for the next kind of usage. AI agents are becoming primary consumers of enterprise data, and they reach for data in patterns, at volumes, and on behalf of identities that look different from the applications and people S3 serves today. We want customers to find the security model simpler and more capable as that shift happens, and to be able to say yes to new uses of their data with confidence. Leading that work is what this role is for.

We are looking for a Principal Engineer to lead the technical direction for security in the Amazon S3 API and Request Processing organization. This organization owns the S3 API surface and the front end of the request path, which makes it the place where every access decision is made. This is a customer-facing security role: you will shape how access to S3 data is expressed by customers, evaluated on the request path, and understood by the people who are accountable for it. You will work across S3 and with partner teams in identity, analytics, and AI, and your designs will be adopted by teams broadly.

The same request path carries S3's performance, availability, and the simplicity of the API itself, and these properties are designed together rather than separately: an access decision that is elegant but slow is not a good design, and an API that is fast but hard to reason about is not either. A Principal Engineer in this organization is expected to shape the request path as a whole and to grow their scope over time, in S3 and beyond it.

Key job responsibilities

Authorization on the request path. Lead the architecture of how access decisions are modeled and evaluated in line with every S3 request. This spans the policy surfaces customers work with, the evaluation and caching that keep those decisions fast at S3 scale, and a model that stays clear and predictable for customers as S3 continues to grow.

A security model customers find easy to reason about. Make the secure path the straightforward one: fewer independent things for a customer to get right, a clear relationship between access to data and access to keys, and controls a customer can explain to their auditors with confidence.

The request path more broadly. Bring the same depth to the other properties the API and request path deliver, including latency, availability, and the design of the API surface customers and AWS services build against, so that security is designed as part of the system rather than layered onto it.

Technical leadership across the organization. Set the standard for how a large engineering organization reasons about security in design reviews and threat models, act as a technical leader on problems well outside your immediate focus, and grow the senior engineers who will raise that bar alongside you.

Basic Qualifications

• Deep experience designing, building, and operating large-scale distributed systems in production
• Depth in at least one security domain relevant to this role, such as authorization and access control, identity, or applied cryptography, and the appetite to build depth in the others
• Experience owning components where correctness, latency, and availability all matter at once
• A track record of technical leadership spanning multiple teams, including designs that other teams adopted
• Experience mentoring and growing senior engineers
• Excellent written and verbal communication, with the ability to move between a design review with engineers and a briefing with senior executives

Preferred Qualifications

• Experience designing authorization systems evaluated on the request path under a strict latency budget
• Experience with high-throughput, low-latency request serving systems
• Experience with policy languages, formal methods, or automated reasoning applied to access control
• Experience with key management and encryption at scale
• Experience with data lake or analytics security: fine-grained access control, row and column level security, or catalog-based governance
• Experience creating architectural vision and influencing groups well beyond your own organization
• Experience representing a technical strategy directly to enterprise customers and their security and compliance teams

Additional information

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If the country/region you're applying in isn't listed, please contact your Recruiting Partner.

Pay and benefits

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave.

USA, WA, Seattle - 200,100.00 - 270,600.00 USD annually