Leo Asset Tracker (LAT) is an internal Amazon application that gives Leo teams real-time visibility into their physical assets - antennas, test equipment, and Hubble trackers - across facilities. It replaces spreadsheets and manual audits with a program-scoped system of record covering device management, live location and geofencing, calibration tracking, device transfers, and built-in audit trails.

The backend is a serverless AWS platform: Python Lambda functions built on aws-lambda-powertools and pydantic, DynamoDB and OpenSearch for storage and search, and a TypeScript AWS CDK package that defines the infrastructure and CI/CD pipeline. The service is secured by a V3 role-based access-control model with per-program scoping. As a backend engineer you will own and extend the APIs, data model, and infrastructure that power the product.

Export Control Requirement

Due to applicable export control laws and regulations, candidates must be a U.S. citizen or national, U.S. permanent resident (i.e., current Green Card holder), or lawfully admitted into the U.S. as a refugee or granted asylum.

Key job responsibilities

- Design, build, and operate Python (AWS Lambda) API domains and event-driven workers, following the domain layer pattern (routes, models, store, permissions) used across the service.

- Own the DynamoDB data model and OpenSearch indexing paths - designing keys, GSIs, and cursor-paginated queries that scale.

- Extend the V3 RBAC security model (roles, permissions, and per-program authorization), guard every endpoint through centralized permission predicates, and manage IAM roles, policies, Bindle-based access controls, and permission boundaries to ensure least-privilege compliance across all services and environments.

- Wire backend changes end-to-end through the TypeScript CDK package: Lambda definitions, IAM grants, environment variables, API Gateway routes, and pipeline stages - owning the security posture of all provisioned AWS resources.

- Lead and participate in security reviews, ensuring alignment with organizational security standards and best practices across infrastructure and application layers.

- Write unit and integration tests, uphold code quality (black, isort, flake8, mypy), and participate in code reviews (CRUX).

- Support the alpha 14 beta 14 gamma 14 prod deployment pipeline, monitoring, and on-call operational excellence for the service.

- Collaborate with frontend (React/Cloudscape) and infrastructure partners to deliver features such as location tracking, geofencing, and device transfers.

BASIC QUALIFICATIONS

- 7+ years of non-internship professional software development experience

- 7+ years of programming with at least one software programming language experience

- 5+ years of leading design or architecture (design patterns, reliability and scaling) of new and existing systems experience

- Experience as a mentor, tech lead or leading an engineering team

- Experience in Python and building and operating production backend services.

- Experience with AWS serverless services (Lambda, DynamoDB, API Gateway, IAM).

- Experience designing REST APIs, data models, and writing automated tests.

- Experience writing clean, well-documented, maintainable code and to reason about security and access control.

PREFERRED QUALIFICATIONS

- 7+ years of full software development life cycle, including coding standards, code reviews, source control management, build processes, testing, and operations experience

- Masters degree in computer science or equivalent

- 1+ years of continuous integration and continuous delivery (CI/CD) experience, or AWS Professional level certification

- 0Experience with aws-lambda-powertools, pydantic, and boto3.

- 0Experience with OpenSearch/Elasticsearch and NoSQL data modeling (single-table, GSIs, pagination).

- 0Familiarity with role-based access control and multi-tenant / program-scoped authorization.

- 0Experience with Amazon internal build and deployment systems (Brazil, Apollo, Pipelines, CRUX).

The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits.

USA, WA, Redmond - 168,100.00 - 227,400.00 USD annually