Role: Cloud Security Engineer / AI Security Engineer
Primary Skills: AWS Bedrock AgentCore Identity, IAM Policy Templates, Cedar Policies, AgentCore Gateway
Job Summary
We are seeking an experienced Security Engineer to design, implement, and manage security frameworks for enterprise Agentic AI applications built on AWS Bedrock AgentCore.
The ideal candidate will have strong expertise in AgentCore Identity, AWS Identity and Access Management (IAM), and Cedar-based fine-grained authorization policies to secure AI agents, tools, APIs, and enterprise integrations.
This role focuses on implementing secure identity management, reusable IAM policy templates, and policy-based access control at the Amazon Bedrock AgentCore Gateway.
Key Responsibilities
1. Amazon Bedrock AgentCore Identity & Authentication
- Design and implement secure identity and authentication solutions using Amazon Bedrock AgentCore Identity.
- Configure inbound and outbound authentication for AI agents accessing enterprise applications, tools, and external APIs.
- Implement OAuth 2.0, OpenID Connect (OIDC), JWT-based authentication, and AWS IAM-based authentication.
- Integrate AgentCore Identity with identity providers such as Amazon Cognito, Microsoft Entra ID, or Okta.
- Configure secure token management, credential handling, and access delegation.
- Implement secure agent-to-agent, agent-to-tool, and agent-to-API access patterns.
- Ensure that agents operate within appropriate identity boundaries and cannot access unauthorized enterprise resources.
2. IAM Policy Templates & Access Management
- Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
- Implement role-based access control (RBAC) and least-privilege security principles.
- Define IAM roles, trust policies, permission boundaries, and resource-based policies.
- Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
- Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
- Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
- Conduct IAM access reviews, permission audits, and policy validation.
- Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.
3. Cedar Policies at AgentCore Gateway
- Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
- Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
- Define policies specifying which identities can invoke particular tools, APIs, and operations.
- Configure policy engines and associate them with AgentCore Gateways.
- Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
- Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
- Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
- Enforce default-deny authorization and prevent unauthorized tool execution.
- Monitor and troubleshoot authorization decisions and policy evaluation failures.
4. Security Governance & Compliance
- Implement security controls for enterprise AI agents and Generative AI applications.
- Develop security standards for agent identities, API integrations, and access management.
- Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
- Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
- Conduct security reviews of agent architecture and integrations.
- Collaborate with AI engineering and DevOps teams to ensure secure production deployments.
5. Security Automation & DevSecOps
- Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
- Integrate IAM and Cedar policy validation into CI/CD workflows.
- Implement automated security checks and policy compliance testing.
- Maintain version-controlled security configurations across development, testing, and production environments.
- Support security incident investigation, access troubleshooting, and remediation.
Required Technical Skills
- AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
- AgentCore Security: AgentCore Identity, AgentCore Gateway, AgentCore Policy.
- Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
- Authentication: OAuth 2.0, OIDC, JWT, AWS IAM authentication.
- Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
- Automation: Python, GitHub Actions, CI/CD security integration.
- Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.