Security Engineer (AWS Bedrock AgentCore / AI Security)

Our client • La, CA

15h

About The Position

Our client is seeking a Security Engineer to design and implement secure identity, authentication, and authorization solutions for Amazon Bedrock AgentCore and enterprise AI applications. The role focuses on architecting fine-grained access controls, developing IAM policy templates, and deploying Cedar authorization policies to enable secure AI agent interactions with enterprise systems and external APIs.

The Security Engineer will configure authentication for AI agents, automate IAM policy deployment, build and deploy Cedar policies, and establish audit logging and security visibility for enterprise AI agents and generative AI applications. The role collaborates with infrastructure and application teams to integrate these security solutions into enterprise AI agent deployments.

Requirements

• 6–10 years of experience in cloud security, identity and access management, or related infrastructure security roles.
• Expert proficiency in AWS IAM, Bedrock AgentCore Identity, Cedar policy language, and IAM policy templates.
• Strong knowledge of OAuth 2.0, OIDC, JWT, RBAC, and ABAC authorization models.
• Hands-on experience with infrastructure-as-code tools: Terraform, AWS CloudFormation, and AWS CDK.
• Proficiency in Python and CI/CD automation tools, particularly GitHub Actions.
• Demonstrated expertise with AWS security services: Secrets Manager, CloudTrail, and CloudWatch.

Nice To Haves

• Familiarity with AgentCore Gateway and fine-grained access control implementations.

Responsibilities

• Design and implement secure identity and authentication solutions using Amazon Bedrock AgentCore Identity, including OAuth 2.0, OIDC, JWT-based, and AWS IAM-based authentication.
• Configure inbound and outbound authentication for AI agents accessing enterprise applications, tools, and external APIs, and integrate AgentCore Identity with providers such as Amazon Cognito, Microsoft Entra ID, or Okta.
• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure, implementing role-based access control and least-privilege principles.
• Automate IAM policy deployment using Terraform, CloudFormation, or AWS CDK, and integrate policy validation and deployment into CI/CD workflows using GitHub Actions.
• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy to enforce fine-grained access controls for AI agents accessing tools through AgentCore Gateway.
• Implement security controls and monitoring for enterprise AI agents and generative AI applications using AWS CloudTrail and CloudWatch for audit logging, access traceability, and security visibility.
• Collaborate with infrastructure and application teams to integrate identity, authentication, and authorization solutions into enterprise AI agent deployments.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed