Security Engineer, Amazon Photos

Mobile security: iOS and Android apps that millions of customers depend on daily

• Smart device integration: Fire TV and Echo platforms where families share their memories
• Backend systems: Where AI helps customers rediscover moments they thought were lost
• Automation frameworks: Because at our scale, manual isn't an option

You'll work directly with senior leadership, but this isn't about following orders. It's about taking initiative, seeing the vulnerabilities before they become problems, building the solutions before they become urgent. You'll have the authority to make decisions and the autonomy to execute them.

The threats are real. They evolve daily. And unlike most security roles, the stakes here are personal - these aren't just business transactions we're protecting, they're first steps, graduations, weddings, last goodbyes.

We are seeking someone that understands that security isn't just about writing code - it's about understanding systems, anticipating attacks, and building defenses that scale. Someone who knows that the best security is invisible to users but impenetrable to attackers.

If you're passionate about both technical excellence and making a difference in people's lives, we'd love to talk with you about joining our team.

Key job responsibilities

1. Cross-Platform Security Leadership

• Drive security architecture and design for Amazon Photos services across backend, iOS, Android, Fire TV, and Echo app platforms
• Perform threat modeling and security reviews for new features and existing systems across all supported platforms
• Partner with development teams to implement security controls and best practices in mobile, TV, and voice-activated environments
• Lead security incident response efforts for assigned services and applications

2. Security Engineering & Implementation

• Design and implement security automation solutions to detect and prevent vulnerabilities across all Photos platforms
• Develop secure-by-default frameworks and reusable components for Photos services and apps
• Perform security code reviews and penetration testing of critical services and client applications
• Build and maintain security monitoring and alerting systems for backend services and client apps

3. Risk Management & Compliance

• Assess and document security risks for Photos services, apps, and customer data across all platforms
• Drive remediation of security findings within SLA requirements
• Ensure compliance with Amazon security standards, DigiSec campaigns, and relevant regulations
• Maintain security documentation and technical designs for all Photos platforms

4. Cross-team Collaboration and Communication

• Collaborate with DigiSec to understand and implement relevant security campaigns and initiatives
• Articulate the security state of Amazon Photos to stakeholders, including progress on DigiSec-driven initiatives
• Produce clear, concise reports on security posture and ongoing initiatives for both technical and non-technical audiences
• Participate in cross-team security reviews and provide expertise on Photos-specific security considerations

5. Continuous Improvement and Innovation

• Stay current with emerging security threats and best practices in mobile, TV, and voice-activated app security
• Propose and implement innovative security solutions that enhance user experience without compromising security
• Contribute to the development of long-term security strategy for Amazon Photos, considering evolving threats and technologies

6. Mentorship and Knowledge Sharing

• Provide technical mentorship to junior security engineers and developers on secure coding practices
• Contribute to security-related documentation and internal knowledge bases
• Participate in and potentially lead security training sessions for the broader Photos team

A day in the life Morning:

• Start your day reviewing security alerts from overnight and sharing news and activity with Amazon Photos development teams
• Join the Photos mobile app team's design review for a new feature enabling secure photo sharing between Echo Show devices
• Conduct a threat modeling session with backend developers for an upcoming service launch
• Collaborate with one of the machine learning teams to validate security controls for a new photo recognition feature

Afternoon:

• Deep dive into analyzing an unusual pattern detected in our subscription activity
• Write and test automation scripts to detect potential privacy issues in photo sharing flows
• Partner with Android developers to implement secure-by-default patterns in their latest feature
• Review pull requests for security-critical changes
• Collaborate with DigiSec on ongoing security campaigns

Evening:

• Forget about work, knowing that we're secure, stable, and safe

About the team We're a focused, high-impact security team being built from the ground up within Amazon Photos. Reporting directly to senior leadership, with technical direction from a Principal Engineer, team members have unprecedented access to guidance and support while maintaining the autonomy to shape our security future.

As one of our first dedicated security engineers, you'll help establish our team's culture and technical foundations. Our dedicated team is starting small, which means you'll have outsized influence on our direction and substantial ownership of our security landscape.

Our flat structure and direct senior leadership access means quick decision-making and minimal bureaucracy. If you enjoy building things from scratch and want to help define what security looks like for a service trusted by millions, this is your opportunity.

4+ years of non-internship background in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools experience

• 5+ years of work in identifying security issues and risks, and developing mitigation plans experience
• 4+ years of (non-internship) scripting, programming, and security code review in common programming languages experience
• Knowledge of at least two of the following programming languages: Scala, Java, Python, C/C++, or Go
• Experience (non-internship) in scripting, programming, and security code reviewing in a common programming language
• Experience (non-internship) in troubleshooting systems issues, analyzing logs, or automating complex tasks using command line tools
• Experience working in identifying security issues and risks, and developing mitigation plans
• Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques
• Experience as a mentor, tech lead or leading an engineering team

Preferred Qualifications

• Experience applying threat modeling or other risk identification techniques or equivalent
• Experience with security in service-oriented architectures/microservices and web services

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, WA, Seattle - 178,400.00 - 226,700.00 USD annually

In the world of cloud security, there's no such thing as a small vulnerability. Billions of photo uploads, AI processing requests, cross-device shares. Each one has to be perfect. Each one has to be secure. Behind every transaction is a family's memories, and those are worth protecting.