Embedded SDE Security, Silicon & Systems Group

Amazons Silicon & Systems Group builds the custom Arm-based SoCs and low-level software that power Fire TV and Amazons streaming media and smart-TV devices. We are looking for a Software Development Engineer II to join our Content Protection & DRM team.

In this role you will design implement and ship the security-critical software that protects premium content on our devices including industry DRM systems (Widevine PlayReady FairPlay) and HDCP link protection (Transmit and Receive). You will write trusted-application (TA) and secure-world code running in a TrustZone/OP-TEE Trusted Execution Environment integrate cryptographic key provisioning and work closely with silicon multimedia and streaming-partner teams to take features from architecture to certified production.
This is a hands-on engineering role with high ownership. Your code runs at the lowest most security-sensitive layers of the stack and directly enables customers to watch the content they love in the highest available quality.

Key job responsibilities
- Design implement test and maintain DRM and content-protection software (Widevine PlayReady FairPlay HDCP 1.x/2.x Tx & Rx) in C/C for embedded Arm platforms.
- Develop trusted applications and secure-world components for a TrustZone/OP-TEE TEE including applied cryptography (AES RSA ECC SHA) and secure key handling.
- Implement and validate secure device key provisioning and factory/development provisioning flows.
- Integrate DRM stacks with the media pipeline and certify content playback with streaming partners (e.g. Prime Video Netflix YouTube).
- Debug complex cross-layer issues spanning firmware kernel drivers TEE and user space; analyze and resolve performance and security defects.
- Participate in security architecture reviews threat modeling code reviews and compliance & robustness certification.
- Write clear design documents and contribute to team engineering standards.

A day in the life
You might start your day integrating a new version of a DRM library into the secure-world TA then debug a decrypt failure that only appears under memory pressure on a specific the afternoon you review a teammates HDCP key-provisioning change sync with the multimedia team on a playback certification blocker and update the design doc for an upcoming SoC bring-up. You are trusted to own your components end to end and you have direct access to hardware senior engineers and the partners who define the standards you implement.

About the team
The DRM team owns the full premium-content security stack across Amazons device SoCs DRM (Widevine/PlayReady/FairPlay) HDCP and the secure video path built on OP-TEE. We are a small high-ownership team of embedded and security engineers who take features from silicon bring-up to certified production and we partner closely with the streaming apps that customers use every day.

- 5 years of embedded firmware development experience
- Experience programming with at least one software programming language or experience in embedded development in C/C
- Bachelors degree or above in computer science electrical engineering or related field
- Experience with Arm SoC bring-up secure boot or security co-processor firmware.
- Hands-on experience with TrustZone OP-TEE or another Trusted Execution Environment and trusted-application development.
- Experience with embedded Linux and low-level software (drivers firmware or system services).
- Experience debugging complex issues across firmware kernel and user space using tools such as JTAG gdb or trace/logging.

- 5 years of full software development life cycle including coding standards code reviews source control management build processes testing and operations experience
- Experience with content protection / DRM (Widevine PlayReady FairPlay) or HDCP.
- Experience developing or integrating trusted applications (TAs) and secure/non-secure world communication.
- Familiarity with secure key provisioning or hardware root-of-trust and secure boot chains (e.g. DICE attestation).
- Applied cryptography experience (AES RSA ECC hashing secure key management).
- Familiarity with the Yocto build system and multimedia/streaming pipelines.

Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process including support for the interview or onboarding process please visit for more information. If the country/region youre applying in isnt listed please contact your Recruiting Partner.