Director Engineering, WorkSpaces Apps, Secure Work Enablement

We are hiring a Director, Engineering to own and scale WorkSpaces Applications - AWS"s fully managed application streaming and virtualization service. Applications enables enterprises to deliver desktop applications securely to any device without rewriting them, serving customers across healthcare, financial services, education, and government. This role will also own Secure Browser - AWS"s fully managed, zero-trust browser streaming service. Secure Browser enables enterprises to provide employees and contractors secure access to internal web applications and the internet without data ever touching the endpoint.

This leader owns the full product stack from browser infrastructure through end-user experience, consuming shared capabilities from our Foundations team while owning the application and browser-specific layers.

Key job responsibilities

Application streaming and fleet management - optimizing elastic fleets, always-on fleets, and multi-session architectures for cost efficiency, density, and performance at scale

Image and application lifecycle - packaging, layering, patching, and rapid provisioning of application stacks across Windows and Linux

Human End-User Experience (owned by this STO) - the Application-specific UX layer: application catalog, session picker, in-app toolbar, file transfer UX, and the streaming viewport experience. Distinct from WorkSpaces UX because users interact with individual applications, not full desktops

Agent-native application delivery - enabling AI agents to discover, launch, interact with, and automate streamed applications programmatically. Working with AgentAccess to define how agents consume applications as a service.

Platform extensibility - APIs, SDKs, and integrations that expand the application ecosystem (SaaS delivery, ISV partnerships, enterprise app stores)

Browser streaming and session management - optimizing standard, large, and xlarge compute tiers for responsiveness, concurrency, and cost efficiency across diverse web application workloads

Zero-trust architecture and data isolation - ensuring no data persists on endpoints, with granular policy controls for clipboard, file transfer, printing, and URL filtering

Agent-native secure browsing - enabling AI agents to securely browse, interact with, and extract data from web applications within the same zero-trust boundary, with full audit trails. Working with AgentAccess to define the agent browsing contract

Identity and access integration - deep integration with enterprise identity providers, conditional access policies, and session-level controls