Cloud Security / AI Security Engineer, AWS IAM, Cedar Policies

This is a fully remote position, open to applicants in Oregon.

📋 Description

• Create, develop, and sustain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.

• Apply RBAC and principles of least-privilege security.

• Establish IAM roles, trust policies, permission boundaries, and resource-based policies.

• Set up IAM execution roles for AgentCore Runtime and AgentCore Gateway.

• Generate standardized IAM templates for Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.

• Automate the deployment of IAM policies using Terraform, AWS CloudFormation, or AWS CDK.

• Perform IAM access reviews, permission audits, and policy validation.

• Resolve access-denied issues, role-assumption failures, and authorization misconfigurations.

• Design, create, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.

• Implement fine-grained authorization and ABAC for AI agents accessing tools via AgentCore Gateway.

• Configure policy engines and link them with AgentCore Gateways.

• Verify Cedar policies against gateway schemas and test allowed and denied access scenarios.

• Enforce default-deny authorization and prevent unauthorized tool execution.

• Monitor and troubleshoot authorization decisions and policy evaluation failures.

• Establish security controls and standards for enterprise AI agents and Generative AI applications.

• Facilitate audit logging, access traceability, and security monitoring utilizing AWS CloudTrail and CloudWatch.

• Identify and mitigate excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.

• Conduct security reviews of agent architecture and integrations.

• Collaborate with AI engineering and DevOps teams for secure production deployments.

• Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.

• Integrate IAM and Cedar policy validation into CI/CD workflows.

• Implement automated security checks and policy compliance testing.

• Maintain version-controlled security configurations across different environments.

• Assist in security incident investigations, access troubleshooting, and remediation.

⛳️ Requirements

• Over 15 years of experience in cloud security and identity management.

• Proven experience securing enterprise AI applications on AWS.

• Familiarity with AWS IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, and CloudWatch.

• Experience with Cedar policy language, RBAC, ABAC, and fine-grained access control.

• Knowledge of OAuth 2.0, OIDC, JWT, and AWS IAM authentication.

• Proficient in Terraform, AWS CDK, or CloudFormation.

• Experience with Python, GitHub Actions, and CI/CD security integration.

• Understanding of least-privilege access, identity federation, credential management, and secure API integrations.

• Must be willing to travel to client sites for workshops and meetings.

🏝️ Benefits

• Opportunity for remote work.

• 10% travel to client sites for workshops and meetings.

• Potential for contract extension.