Remote Identity & Access Engineer: AgentCore, OBO & Federation

Intellias; España; Remote; EUR 90,000 - 130,000; Full time

Job summary

Intellias is seeking a Senior Identity & Access Management Engineer to design secure identity propagation across AI agent ecosystems, including OBO token exchange and identity federation. The role emphasizes runtime identity integration, per-target credential management, and threat-aware architecture across tool-to-API chains.

Remote from Spain with an indefinite Spanish contract, you will work within the Core Architecture Team on enterprise platform identity controls, Cedar policies, and

Qualifications

• 5+ years cloud security or identity engineering experience.
• Experience with OAuth 2.0, OIDC, JWT validation and token exchange.
• Experience with enterprise identity federation (MS Entra, Okta, Cognito).
• Experience with workload identity brokering and policy-based access control.
• Experience with AWS Bedrock AgentCore Identity or similar.

Responsibilities

• Design and implement secure identity propagation across agent to tool to API interaction chains.
• Build and support On-Behalf-Of (OBO) token exchange flows and scoped delegation.
• Integrate AWS Bedrock AgentCore Identity capabilities into agent runtime workflows.
• Implement OAuth 2.0, OpenID Connect (OIDC), and JWT-based authentication and authorization patterns.
• Develop identity federation integrations with enterprise identity providers (Entra ID, Okta, Cognito).
• Configure gateway-level outbound authorization and per-target credential management.
• Build secure token issuance, validation, exchange, rotation and lifecycle management processes.
• Design workload identity brokering and agent identity mapping mechanisms.
• Implement identity-aware authorization controls using Cedar policies and claims mapping.
• Collaborate with platform, security, and runtime teams on enterprise security standards.

Skills

Identity engineering

OBO token exchange

Enterprise federation

Secret management

AWS Bedrock

OIDC/OAuth 2.0

Workload identity brokering

MS Entra / Okta / Cognito

JWT validation

Policy-based access control

Job description

Intellias is seeking a Senior Identity & Access Management Engineer to design secure identity propagation across AI agent ecosystems, including OBO token exchange and identity federation. The role emphasizes runtime identity integration, per-target credential management, and threat-aware architecture across tool-to-API chains.

Remote from Spain with an indefinite Spanish contract, you will work within the Core Architecture Team on enterprise platform identity controls, Cedar policies, and