Cloud Security Engineer / AI Security Engineer

We're Hiring: Cloud Security Engineer / AI Security Engineer! Primary Skills: AWS Bedrock AgentCore Identity, IAM Policy Templates, Cedar Policies, AgentCore GatewayDuration: 3+ Months with possible extensionLocation: Los Angeles, CA (Local to CA or LA only)Job Summary

We are seeking an experienced Security Engineer to design, implement, and manage security frameworks for enterprise Agentic AI applications built on AWS Bedrock AgentCore.

The ideal candidate will have strong expertise in AgentCore Identity, AWS Identity and Access Management (IAM), and Cedar-based fine-grained authorization policies to secure AI agents, tools, APIs, and enterprise integrations.

This role focuses on implementing secure identity management, reusable IAM policy templates, and policy-based access control at the Amazon Bedrock AgentCore Gateway.

Key Responsibilities1. Amazon Bedrock AgentCore Identity & Authentication

• Design and implement secure identity and authentication solutions using Amazon Bedrock AgentCore Identity.
• Configure inbound and outbound authentication for AI agents accessing enterprise applications, tools, and external APIs.
• Implement OAuth 2.0, OpenID Connect (OIDC), JWT-based authentication, and AWS IAM-based authentication.
• Integrate AgentCore Identity with identity providers such as Amazon Cognito, Microsoft Entra ID, or Okta.
• Configure secure token management, credential handling, and access delegation.
• Implement secure agent-to-agent, agent-to-tool, and agent-to-API access patterns.
• Ensure that agents operate within appropriate identity boundaries and cannot access unauthorized enterprise resources.

2. IAM Policy Templates & Access Management

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
• Implement role-based access control (RBAC) and least-privilege security principles.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
• Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
• Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
• Conduct IAM access reviews, permission audits, and policy validation.
• Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

3. Cedar Policies at AgentCore Gateway

• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
• Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.