Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

TMS LLC•Remote, OR

2d•Remote

About The Position

Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources. The position is remote, based in Los Angeles, CA, with 10% travel to client sites for workshops and meetings. The stated duration is 3+ months, with an extension possible.

Requirements

15+ years of experience in cloud security and identity management.
Experience with AWS IAM, IAM roles and policies, STS, AWS Secrets Manager, CloudTrail, and CloudWatch.
Knowledge of Cedar policy language, RBAC, ABAC, and fine-grained access control.
Experience with OAuth 2.0, OIDC, JWT, and AWS IAM authentication.
Experience with Terraform, AWS CDK, or CloudFormation.
Experience with Python, GitHub Actions, and CI/CD security integration.
Knowledge of least-privilege access, identity federation, credential management, and secure API integrations.
Must be comfortable traveling to client sites for workshops and meetings.

Responsibilities

Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
Implement role-based access control and least-privilege security principles.
Define IAM roles, trust policies, permission boundaries, and resource-based policies.
Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
Develop standardized IAM templates for AWS services including Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
Conduct IAM access reviews, permission audits, and policy validation.
Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.
Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
Define policies governing which identities can invoke particular tools, APIs, and operations.
Configure policy engines and associate them with AgentCore Gateways.
Implement attribute-based access control using identity attributes, roles, scopes, and contextual conditions.
Develop policies restricting sensitive tool operations according to business roles, permissions, and security requirements.
Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
Enforce default-deny authorization and prevent unauthorized tool execution.
Monitor and troubleshoot authorization decisions and policy evaluation failures.
Implement security controls for enterprise AI agents and Generative AI applications.
Develop security standards for agent identities, API integrations, and access management.
Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
Conduct security reviews of agent architecture and integrations.
Collaborate with AI engineering and DevOps teams to ensure secure production deployments.
Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
Integrate IAM and Cedar policy validation into CI/CD workflows.
Implement automated security checks and policy compliance testing.
Maintain version-controlled security configurations across development, testing, and production environments.
Support security incident investigation, access troubleshooting, and remediation.