Senior Security Engineer, Special Projects

Amazon Special Projects is building distributed infrastructure that runs across compute environments Amazon does not fully control, with a focus on making security guarantees practical in that setting. In this role, you will own end-to-end threat modeling for the platform architecture and translate findings into concrete engineering deliverables that support secure-by-design operation.

Role overview

As a Senior Security Engineer, Special Projects, you will focus on distributed infrastructure protections including attestation, encrypted workload delivery, result integrity verification, API authentication, and workload isolation guarantees. You will author the threat model and ensure it is reflected in engineering through secure interfaces, validation mechanisms, and supporting documentation.

Responsibilities

• Author the threat model for the platform architecture, identifying attack surfaces across compute nodes, network transit, and the control plane.
• Design and implement an attestation flow to verify node integrity before workloads are dispatched, using TPM and TEE where available and defining fallback assurance levels.
• Specify and validate encrypted workload delivery, protecting model weights and inference inputs and outputs at rest and in transit.
• Build result integrity verification mechanisms, conduct security reviews, prepare for penetration testing, and author compliance documentation.

Requirements

• Knowledge of at least two programming languages: Scala, Java, Python, C/C++, or Go.
• Non-internship experience troubleshooting system issues, analyzing logs, or automating complex tasks using command line tools.
• Non-internship experience identifying security vulnerabilities, attack patterns, and remediation techniques.
• Experience mentoring, serving as a tech lead, or leading an engineering team.
• Experience with threat modeling and penetration testing, or strong analytical skills with attention to detail and effective communication, plus experience in Linux and networking protocols.
• Deep expertise in hardware attestation (TPM, TEE, secure enclaves) and cryptographic protocols.
• 7+ years of security engineering experience, including at least 3 years focused on systems or infrastructure security.
• Strong understanding of zero-trust architectures and practical implementation.
• Experience with secure API design, authentication, and authorization frameworks.

Technologies

• Scala, Java, Python, C/C++, Go
• TPM, TEE, secure enclaves
• Linux, TPM/TEE
• Zero-trust architectures, API authentication
• Authentication, authorization

Preferred qualifications

• Experience applying threat modeling or other risk identification techniques or equivalent.
• Knowledge of cloud computing services and deployment architecture.
• Experience performing technical audits or assessments supporting major compliance efforts (for example: ISO, NIST, SOX, PCI, HIPAA, GDPR and other regulatory or industry certifications).
• Experience securing edge or distributed platforms where hardware is not under direct organizational control.
• Background in secure enclave programming (Intel SGX, ARM TrustZone, or AWS Nitro Enclaves).
• Familiarity with ML model protection, including model watermarking or obfuscation techniques.
• Published research or patents in applied cryptography, remote attestation, or secure computation.

Location and compensation

• Location: Seattle, WA (onsite)
• Salary: USD 178,400 - 226,700 per year
• Minimum experience: 7 years

Benefits

• Sign-on payments
• Restricted stock units (RSUs)
• Health insurance (medical, dental, vision, prescription)
• Basic Life & AD&D insurance and option for Supplemental life plans
• EAP, Mental Health Support, Medical Advice Line
• Flexible Spending Accounts
• Adoption and Surrogacy Reimbursement coverage
• 401(k) matching
• Paid time off
• Parental leave

About the team

Amazon Special Projects is focused on designing a trust model that makes this distributed architecture viable. That includes ensuring workloads are protected, results are verifiable, and the platform meets a security bar that supports confidence from internal and external customers.