Embedded SDE - Security, Silicon & Systems Group
Amazon's Silicon & Systems Group builds the custom Arm-based SoCs and low-level software that power Fire TV and Amazon's streaming media and smart-TV devices. We are looking for a Software Development Engineer II to join our Content Protection & DRM team.
In this role you will design, implement, and ship the security-critical software that protects premium content on our devices — including industry DRM systems (Widevine, PlayReady, FairPlay) and HDCP link protection (Transmit and Receive). You will write trusted-application (TA) and secure-world code running in a TrustZone/OP-TEE Trusted Execution Environment, integrate cryptographic key provisioning, and work closely with silicon, multimedia, and streaming-partner teams to take features from architecture to certified production.
This is a hands-on engineering role with high ownership. Your code runs at the lowest, most security-sensitive layers of the stack, and directly enables customers to watch the content they love in the highest available quality.
Key job responsibilities
- Design, implement, test, and maintain DRM and content-protection software (Widevine, PlayReady, FairPlay, HDCP 1.x/2.x Tx & Rx) in C/C++ for embedded Arm platforms.
- Develop trusted applications and secure-world components for a TrustZone/OP-TEE TEE, including applied cryptography (AES, RSA, ECC, SHA) and secure key handling.
- Implement and validate secure device key provisioning and factory/development provisioning flows.
- Integrate DRM stacks with the media pipeline and certify content playback with streaming partners (e.g., Prime Video, Netflix, YouTube).
- Debug complex, cross-layer issues spanning firmware, kernel drivers, TEE, and user space; analyze and resolve performance and security defects.
- Participate in security architecture reviews, threat modeling, code reviews, and compliance & robustness certification.
- Write clear design documents and contribute to team engineering standards.
A day in the life
You might start your day integrating a new version of a DRM library into the secure-world TA, then debug a decrypt failure that only appears under memory pressure on a specific device. In the afternoon you review a teammate's HDCP key-provisioning change, sync with the multimedia team on a playback certification blocker, and update the design doc for an upcoming SoC bring-up. You are trusted to own your components end to end, and you have direct access to hardware, senior engineers, and the partners who define the standards you implement.
About the team
The DRM team owns the full premium-content security stack across Amazon's device SoCs — DRM (Widevine/PlayReady/FairPlay), HDCP, and the secure video path built on OP-TEE. We are a small, high-ownership team of embedded and security engineers who take features from silicon bring-up to certified production, and we partner closely with the streaming apps that customers use every day.
In this role you will design, implement, and ship the security-critical software that protects premium content on our devices — including industry DRM systems (Widevine, PlayReady, FairPlay) and HDCP link protection (Transmit and Receive). You will write trusted-application (TA) and secure-world code running in a TrustZone/OP-TEE Trusted Execution Environment, integrate cryptographic key provisioning, and work closely with silicon, multimedia, and streaming-partner teams to take features from architecture to certified production.
This is a hands-on engineering role with high ownership. Your code runs at the lowest, most security-sensitive layers of the stack, and directly enables customers to watch the content they love in the highest available quality.
Key job responsibilities
- Design, implement, test, and maintain DRM and content-protection software (Widevine, PlayReady, FairPlay, HDCP 1.x/2.x Tx & Rx) in C/C++ for embedded Arm platforms.
- Develop trusted applications and secure-world components for a TrustZone/OP-TEE TEE, including applied cryptography (AES, RSA, ECC, SHA) and secure key handling.
- Implement and validate secure device key provisioning and factory/development provisioning flows.
- Integrate DRM stacks with the media pipeline and certify content playback with streaming partners (e.g., Prime Video, Netflix, YouTube).
- Debug complex, cross-layer issues spanning firmware, kernel drivers, TEE, and user space; analyze and resolve performance and security defects.
- Participate in security architecture reviews, threat modeling, code reviews, and compliance & robustness certification.
- Write clear design documents and contribute to team engineering standards.
A day in the life
You might start your day integrating a new version of a DRM library into the secure-world TA, then debug a decrypt failure that only appears under memory pressure on a specific device. In the afternoon you review a teammate's HDCP key-provisioning change, sync with the multimedia team on a playback certification blocker, and update the design doc for an upcoming SoC bring-up. You are trusted to own your components end to end, and you have direct access to hardware, senior engineers, and the partners who define the standards you implement.
About the team
The DRM team owns the full premium-content security stack across Amazon's device SoCs — DRM (Widevine/PlayReady/FairPlay), HDCP, and the secure video path built on OP-TEE. We are a small, high-ownership team of embedded and security engineers who take features from silicon bring-up to certified production, and we partner closely with the streaming apps that customers use every day.