Security Engineer (AWS Bedrock AgentCore / AI Security)

Our client is seeking a Security Engineer to design and implement secure identity, authentication, and authorization solutions for Amazon Bedrock AgentCore and enterprise AI applications. You will architect fine-grained access controls, develop IAM policy templates, and deploy Cedar authorization policies to enable secure AI agent interactions with enterprise systems and external APIs.

Responsibilities & Qualifications

• Design and implement secure identity and authentication solutions using Amazon Bedrock AgentCore Identity, including OAuth 2.0, OIDC, JWT-based, and AWS IAM-based authentication mechanisms
• Configure inbound and outbound authentication for AI agents accessing enterprise applications, tools, and external APIs; integrate AgentCore Identity with providers such as Amazon Cognito, Microsoft Entra ID, or Okta
• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure; implement role-based access control (RBAC) and least-privilege security principles
• Automate IAM policy deployment using Terraform, CloudFormation, or AWS CDK; integrate policy validation and deployment into CI/CD workflows via GitHub Actions
• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy to enforce fine-grained access controls for AI agents accessing tools through AgentCore Gateway
• Implement security controls and monitoring for enterprise AI agents and Generative AI applications using AWS CloudTrail and CloudWatch for audit logging, access traceability, and security visibility
• Collaborate with infrastructure and application teams to integrate identity, authentication, and authorization solutions into enterprise AI agent deployments

Requirements

• 6–10 years of experience in cloud security, identity and access management, or related infrastructure security roles
• Expert proficiency in AWS IAM, Bedrock AgentCore Identity, Cedar policy language, and IAM policy templates
• Strong knowledge of OAuth 2.0, OIDC, JWT, RBAC, and ABAC authorization models
• Hands-on experience with infrastructure-as-code tools: Terraform, AWS CloudFormation, and AWS CDK
• Proficiency in Python and CI/CD automation tools, particularly GitHub Actions
• Demonstrated expertise with AWS security services: Secrets Manager, CloudTrail, and CloudWatch
• Familiarity with AgentCore Gateway and fine-grained access control implementations