Principal Software Development Engineer

Amazon S3 holds the world"s data. Customers of every size build on it because it gives them durability, scale, and control they can rely on, and because the controls around their data are as much a part of the product as the storage itself. Every request to S3 carries an authorization decision, made in line, at S3"s request rate, within a latency budget measured in a small fraction of the request. That combination of scale, precision, and speed makes security in S3 one of the most interesting distributed systems problems at AWS.

We are building S3 for the next kind of usage. AI agents are becoming primary consumers of enterprise data, and they reach for data in patterns, at volumes, and on behalf of identities that look different from the applications and people S3 serves today. We want customers to find the security model simpler and more capable as that shift happens, and to be able to say yes to new uses of their data with confidence. Leading that work is what this role is for.

We are looking for a Principal Engineer to lead the technical direction for security in the Amazon S3 API and Request Processing organization. This organization owns the S3 API surface and the front end of the request path, which makes it the place where every access decision is made. This is a customer-facing security role: you will shape how access to S3 data is expressed by customers, evaluated on the request path, and understood by the people who are accountable for it. You will work across S3 and with partner teams in identity, analytics, and AI, and your designs will be adopted by teams broadly.

The same request path carries S3"s performance, availability, and the simplicity of the API itself, and these properties are designed together rather than separately: an access decision that is elegant but slow is not a good design, and an API that is fast but hard to reason about is not either. A Principal Engineer in this organization is expected to shape the request path as a whole and to grow their scope over time, in S3 and beyond it.

Key job responsibilities

Authorization on the request path. Lead the architecture of how access decisions are modeled and evaluated in line with every S3 request. This spans the policy surfaces customers work with, the evaluation and caching that keep those decisions fast at S3 scale, and a model that stays clear and predictable for customers as S3 continues to grow.

A security model customers find easy to reason about. Make the secure path the straightforward one: fewer independent things for a customer to get right, a clear relationship between access to data and access to keys, and controls a customer can explain to their auditors with confidence.

The request path more broadly. Bring the same depth to the other properties the API and request path deliver, including latency, availability, and the design of the API surface customers and AWS services build against, so that security is designed as part of the system rather than layered onto it.

Technical leadership across the organization. Set the standard for how a large engineering organization reasons about security in design reviews and threat models, act as a technical leader on problems well outside your immediate focus, and grow the senior engineers who will raise that bar alongside you.

About the team

The S3 API and Request Processing organization owns the API that customers and AWS services use to reach their data, and the front end of the path that serves every request. It is a high-scale, high-availability systems organization, and it is where the properties customers most associate with S3 are delivered on each call. The team works closely with partners across storage, identity, analytics, and AI, and its work is visible in the daily experience of nearly every AWS customer.