Senior Security Engineer, Special Projects

Cybersecurity Jobs; Seattle (WA); On-site; USD 178,000 - 227,000; Full time

Benefits offered by this job

Sign-on payments

RSUs

Health insurance

Life insurance

Mental health support

Flexible Spending Accounts

Parental leave

401(k) matching

Paid time off

Job summary

Amazon Special Projects is seeking a seasoned security engineer to shape trust models for secure by design operations, protecting workloads and enabling verifiable results across distributed compute environments. You will drive end-to-end threat modeling, attestations, and secure API design to uphold security across the platform.

Role requires 7+ years in security engineering, deep hardware attestation expertise (TPM/TEE), and strong experience with zero-trust implementations in an on-site

Qualifications

• Knowledge of at least two programming languages: Scala, Java, Python, C/C++, or Go.
• Non-internship experience troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools.
• Non-internship experience identifying security vulnerabilities, attack patterns, and remediation techniques based on industry experience.
• Experience mentoring, serving as a tech lead, or leading an engineering team.
• Experience with threat modeling and penetration testing, or experience combining strong analytical skills, attention to detail, and effective communication, including Linux and networking protocols.
• Deep expertise in hardware attestation (TPM, TEE, secure enclaves) and cryptographic protocols.
• 7+ years of security engineering experience, with at least 3 years focused on systems or infrastructure security.
• Strong understanding of zero-trust architectures and practical implementation.
• Experience with secure API design, authentication, and authorization frameworks.

Responsibilities

• Author the threat model for the platform architecture, mapping attack surfaces across compute nodes, network transit, and the control plane.
• Design and implement an attestation flow that verifies node integrity before workloads are dispatched, using TPM/TEE where available and defining fallback assurance levels.
• Specify and validate encrypted workload delivery, including protection of model weights and inference inputs/outputs at rest and in transit.
• Build result integrity verification mechanisms, run security reviews, help prepare for penetration testing, and author compliance documentation.

Skills

Scala

Java

Python

C/C++

Go

Job description

Join Amazon Special Projects in building distributed infrastructure that runs across compute environments Amazon does not fully control. In this role, you will shape a trust model for secure by design operations, ensuring workloads are protected, results can be verified, and the platform reaches the security bar that supports confidence from internal and external customers. The work spans end-to-end threat modeling and translating findings into concrete engineering deliverables.

Location: Seattle, WA (onsite) | Experience: 7+ years | Compensation: USD 178,400 - 226,700 per year

What you’ll own

• Author the threat model for the platform architecture, mapping attack surfaces across compute nodes, network transit, and the control plane.
• Design and implement an attestation flow that verifies node integrity before workloads are dispatched, using TPM/TEE where available and defining fallback assurance levels.
• Specify and validate encrypted workload delivery, including protection of model weights and inference inputs/outputs at rest and in transit.
• Build result integrity verification mechanisms, run security reviews, help prepare for penetration testing, and author compliance documentation.

Required qualifications

• Knowledge of at least two programming languages: Scala, Java, Python, C/C++, or Go.
• Non-internship experience troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools.
• Non-internship experience identifying security vulnerabilities, attack patterns, and remediation techniques based on industry experience.
• Experience mentoring, serving as a tech lead, or leading an engineering team.
• Experience with threat modeling and penetration testing, or experience combining strong analytical skills, attention to detail, and effective communication, including Linux and networking protocols.
• Deep expertise in hardware attestation (TPM, TEE, secure enclaves) and cryptographic protocols.
• 7+ years of security engineering experience, with at least 3 years focused on systems or infrastructure security.
• Strong understanding of zero-trust architectures and practical implementation.
• Experience with secure API design, authentication, and authorization frameworks.

Preferred qualifications

• Experience applying threat modeling or other risk identification techniques or equivalent knowledge.
• Knowledge of cloud computing services and deployment architecture.
• Experience performing technical audits or assessments supporting major compliance efforts (examples: ISO, NIST, SOX, PCI, HIPAA, GDPR and other regulatory/industry certifications).
• Experience securing edge or distributed platforms where hardware is not under direct organizational control.
• Background in secure enclave programming (examples: Intel SGX, ARM TrustZone, AWS Nitro Enclaves).
• Familiarity with ML model protection, including model watermarking or obfuscation techniques.
• Published research or patents in applied cryptography, remote attestation, or secure computation.

Benefits

• Sign-on payments
• Restricted stock units (RSUs)
• Health insurance (medical, dental, vision, prescription)
• Basic Life & AD&D insurance and option for Supplemental life plans
• EAP, Mental Health Support, Medical Advice Line
• Flexible Spending Accounts
• Adoption and Surrogacy Reimbursement coverage
• 401(k) matching
• Paid time off
• Parental leave

Technologies you’ll work with

Scala, Java, Python, C/C++, Go, TPM, TEE, secure enclaves, Linux, TPM/TEE, zero-trust architectures, API authentication, authentication, authorization.