The same request path carries S3's performance, availability, and the simplicity of the API itself, and these properties are designed together rather than separately: an access decision that is elegant but slow is not a good design, and an API that is fast but hard to reason about is not either. A Principal Engineer in this organization is expected to shape the request path as a whole and to grow their scope over time, in S3 and beyond it.
Key job responsibilities
Authorization on the request path. Lead the architecture of how access decisions are modeled and evaluated in line with every S3 request. This spans the policy surfaces customers work with, the evaluation and caching that keep those decisions fast at S3 scale, and a model that stays clear and predictable for customers as S3 continues to grow.
A security model customers find easy to reason about. Make the secure path the straightforward one: fewer independent things for a customer to get right, a clear relationship between access to data and access to keys, and controls a customer can explain to their auditors with confidence.
The request path more broadly. Bring the same depth to the other properties the API and request path deliver, including latency, availability, and the design of the API surface customers and AWS services build against, so that security is designed as part of the system rather than layered onto it.
Technical leadership across the organization. Set the standard for how a large engineering organization reasons about security in design reviews and threat models, act as a technical leader on problems well outside your immediate focus, and grow the senior engineers who will raise that bar alongside you.
About the team
The S3 API and Request Processing organization owns the API that customers and AWS services use to reach their data, and the front end of the path that serves every request. It is a high-scale, high-availability systems organization, and it is where the properties customers most associate with S3 are delivered on each call. The team works closely with partners across storage, identity, analytics, and AI, and its work is visible in the daily experience of nearly every AWS customer.
Deep experience designing, building, and operating large-scale distributed systems in production
Depth in at least one security domain relevant to this role, such as authorization and access control, identity, or applied cryptography, and the appetite to build depth in the others
Experience owning components where correctness, latency, and availability all matter at once
A track record of technical leadership spanning multiple teams, including designs that other teams adopted
Experience mentoring and growing senior engineers
Excellent written and verbal communication, with the ability to move between a design review with engineers and a briefing with senior executives
Experience designing authorization systems evaluated on the request path under a strict latency budget
Experience with high-throughput, low-latency request serving systems
Experience with policy languages, formal methods, or automated reasoning applied to access control
Experience with key management and encryption at scale
Experience with data lake or analytics security: fine-grained access control, row and column level security, or catalog-based governance
Experience creating architectural vision and influencing groups well beyond your own organization
Experience representing a technical strategy directly to enterprise customers and their security and compliance teams
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.
The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.
USA, WA, Seattle - 200,100.00 - 270,600.00 USD annually
