Amazon Web Services is looking for a Sr. Software Development Engineer to join our growing Amazon Elastic Container Services for Kubernetes (EKS) team. Amazon EKS is our managed Kubernetes service that makes it easy for customers to use Kubernetes without needing to become experts in provisioning and operating Kubernetes. EKS manages time-consuming administrative tasks like setting up, operating, scaling and updating Kubernetes, freeing customers up to focus on their applications.
The EKS Networking team builds the networking stack that connects customer workloads running on EKS clusters. We own the VPC CNI, which runs in the majority of EKS clusters worldwide, and an eBPF-based network policy enforcement path that replaced third-party dependencies with a native implementation. We are now building a service mesh, an Istio or Istio-like capability (traffic management, mTLS, policy, and observability) that avoids the per-pod sidecar tax by leaning on the kernel and the networking stack we already own. You will be joining a fast paced team working on greenfield projects, building the control plane for that mesh.
You will own the control plane: the system that turns customer intent (routing rules, policy, identity) into live configuration distributed to the data path across large clusters. You own service discovery, the config-distribution surface, and the mTLS identity and certificate-rotation story end to end. You will be solving challenging technical problems, often ones not solved before, alongside peers with remarkable technical expertise. The solutions you build will be high impact and rolled out to our large customer base across the world. If you are excited to work in a dynamic environment, we would love to hear from you!
Key job responsibilities
Key job responsibilities
- Design and build the control plane that distributes configuration to the mesh data path at scale, including the config-distribution protocol (xDS or equivalent) and its efficiency and convergence properties.
- Own service discovery and endpoint health across large, high-churn clusters, including on-demand lookup patterns for very large endpoint counts rather than replicating full state everywhere.
- Own the mTLS identity story: SPIFFE-style identity issuance, certificate rotation, trust domains, and Layer 4 authorization policy.
- Guarantee control-loop correctness: convergence, staleness bounds, caching, and graceful behavior under failure.
- Partner with the data path, kernel/eBPF, and protocols engineers whose subsystems consume the configuration you distribute.
- Raise the bar through design and code reviews, and mentor engineers on the team.
