Senior Engineer, Applied AI & Build Standards

Best Buy • Richfield, MN

3d • Hybrid

About The Position

As a Senior Engineer on Best Buy’s Applied AI & Build Standards team, you will help AI agents work safely alongside employees as trusted, accountable participants. You will build agent identity capabilities—enabling agents to act on a person’s behalf with only the access they need and leaving a clear record—and governed team/agent workspaces where people and agents work together. The AI Rails team builds a shared platform and sets standards that enable Best Buy engineers and technologists to use AI agents with appropriate access, security, and cost controls.

The role is remote-eligible: work virtually from home or another non-Best Buy location anywhere in the U.S., or hybrid at the corporate campus in Richfield, Minnesota. Work arrangements vary by role and team; the recruiter or hiring manager will provide details during the hiring process. The role is eligible for immigration sponsorship.

Requirements

• Bachelor’s degree in IT, Computer Science, Engineering, or a related field, or an equivalent combination of education and/or experience.
• At least 3 years of related work experience as a Software Engineer or Software Developer.
• At least 2 years of engineering enterprise identity and access management, including OAuth 2.0, OpenID Connect, and SAML.
• At least 1 year of engineering experience with an enterprise identity provider such as Microsoft Entra ID, Okta, or PingFederate.
• At least 1 year of experience with development or automation in Python, C#, Go, or a similar language.
• Hands-on experience, at work or independently, giving AI agents their own identities or delegated access to real systems.
• Daily, hands-on use of AI coding agents in designing, building, and reviewing software.

Nice To Haves

• Bachelor’s degree in IT, Computer Science, Engineering, or a related field.
• 5 or more years of experience as a software engineer.
• Experience with delegated authorization, including OAuth 2.0 Token Exchange (RFC 8693) or on-behalf-of flows, with per-target, least-privilege tokens.
• Experience with Microsoft Entra ID in a hybrid Active Directory environment, including workload and agent identities.
• Experience with managed cloud desktops or developer environments, such as Windows 365 Cloud PCs and Microsoft Intune.

Responsibilities

• Automate the agent identity lifecycle in Microsoft Entra ID, including passwordless agent accounts, approvals, credential rotation, revocation, and decommissioning.
• Implement the identity contract enforced by the AI gateway, including token minting, on-behalf-of exchange, and least-privilege scopes.
• Bridge agent identities into the SAML and OIDC federation used by internal applications, mapping on-premises groups to cloud scopes.
• Build governed team/agent workspaces in collaboration tools, along with devboxes and cloud PCs, keeping test accounts separate from production.
• Carry user and agent identity end to end from collaboration tools into immutable audit logs.
• Lead delivery from design through deployment, contribute to architecture decisions, and support colleagues through code reviews and mentoring.
• Use Agentic AI as a core development and coding tool.

Benefits

• Competitive pay.
• Great employee discount.
• Financial savings and retirement resources.
• Support for physical and mental well-being.
• Leaves of absence and potential pay sources, subject to eligibility and applicable terms.
• Paid time off (vacation or PTO), subject to eligibility and applicable terms.
• Certain roles may be eligible for incentive pay, subject to eligibility.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior