Embedded Software Development Engineer, Security

- 5+ years of embedded firmware development experience
- Experience programming with at least one software programming language, or experience in embedded development in C/C++
- Bachelor's degree or above in computer science, electrical engineering, or related field
- Experience with Arm SoC bring-up, secure boot, or security co-processor firmware.
- Hands-on experience with TrustZone, OP-TEE, or another Trusted Execution Environment and trusted-application development.
- Experience with embedded Linux and low-level software (drivers, firmware, or system services).
- Experience debugging complex issues across firmware, kernel, and user space using tools such as JTAG, gdb, or trace/logging.
- 5+ years of full software development life cycle, including coding standards, code reviews, source control management, build processes, testing, and operations experience
- Experience with content protection / DRM (Widevine, PlayReady, FairPlay) or HDCP.
- Experience developing or integrating trusted applications (TAs) and secure/non-secure world communication.
- Familiarity with secure key provisioning, or hardware root-of-trust and secure boot chains (e.g., DICE, attestation).
- Applied cryptography experience (AES, RSA, ECC, hashing, secure key management).
- Familiarity with the Yocto build system and multimedia/streaming pipelines.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.
Amazon's Silicon & Systems Group builds the custom Arm-based SoCs and low-level software that power Fire TV and Amazon's streaming media and smart-TV devices. We are looking for a Software Development Engineer II to join our Content Protection & DRM team.

In this role you will design, implement, and ship the security-critical software that protects premium content on our devices — including industry DRM systems (Widevine, PlayReady, FairPlay) and HDCP link protection (Transmit and Receive). You will write trusted-application (TA) and secure-world code running in a TrustZone/OP-TEE Trusted Execution Environment, integrate cryptographic key provisioning, and work closely with silicon, multimedia, and streaming-partner teams to take features from architecture to certified production.
This is a hands-on engineering role with high ownership. Your code runs at the lowest, most security-sensitive layers of the stack, and directly enables customers to watch the content they love in the highest available quality.

Key job responsibilities
- Design, implement, test, and maintain DRM and content-protection software (Widevine, PlayReady, FairPlay, HDCP 1.x/2.x Tx & Rx) in C/C++ for embedded Arm platforms.
- Develop trusted applications and secure-world components for a TrustZone/OP-TEE TEE, including applied cryptography (AES, RSA, ECC, SHA) and secure key handling.
- Implement and validate secure device key provisioning and factory/development provisioning flows.
- Integrate DRM stacks with the media pipeline and certify content playback with streaming partners (e.g., Prime Video, Netflix, YouTube).
- Debug complex, cross-layer issues spanning firmware, kernel drivers, TEE, and user space; analyze and resolve performance and security defects.
- Participate in security architecture reviews, threat modeling, code reviews, and compliance & robustness certification.
- Write clear design documents and contribute to team engineering standards.

A day in the life
You might start your day integrating a new version of a DRM library into the secure-world TA, then debug a decrypt failure that only appears under memory pressure on a specific device. In the afternoon you review a teammate's HDCP key-provisioning change, sync with the multimedia team on a playback certification blocker, and update the design doc for an upcoming SoC bring-up. You are trusted to own your components end to end, and you have direct access to hardware, senior engineers, and the partners who define the standards you implement.

About the team
The DRM team owns the full premium-content security stack across Amazon's device SoCs — DRM (Widevine/PlayReady/FairPlay), HDCP, and the secure video path built on OP-TEE. We are a small, high-ownership team of embedded and security engineers who take features from silicon bring-up to certified production, and we partner closely with the streaming apps that customers use every day.