Chief Security Architect for AI Agent Platform

EPAM Systems; Polska; Hybrid; PLN 320,000 - 520,000; Full time

Benefits offered by this job

Hybrid work model

Relocation opportunities

English classes

Job summary

EPAM Systems, Inc. is seeking a Lead Security / Policy Engineer to architect the policy engine, Cedar policy schema, and InfoSec review processes for an enterprise-grade Agent Development Platform.

You will define authorization models for agent-to-agent communication and OAuth/JWT-based identity-aware controls in a cloud-native AWS environment. The role emphasizes default-deny strategies, policy-as-code governance, and staged rollout from observation to enforcement.

Qualifications

• 5+ years in cloud security or identity engineering.
• Hands-on authorization/policy-as-code for AI agents in production.
• Expertise in OAuth 2.0, JWT, and claims mapping.
• RBAC and ABAC design experience.
• Experience with Cedar or OPA or direct A2A protocol depth.
• Experience leading enterprise security review processes.

Responsibilities

• Architect policy engine and Cedar schema across the platform.
• Define authorization models for agent-to-agent capability advertisement and invocation.
• Drive enterprise InfoSec review processes and ARB alignment.
• Establish default-deny patterns for agent interactions.
• Integrate identity-aware authorization using OAuth 2.0, JWT, and claims mapping.
• Build and maintain policy-as-code patterns for governance.
• Oversee audit logging for policy decisions and enforcement outcomes.
• Guide staged rollout from monitoring to enforcement.
• Collaborate with engineering on trust boundaries between agents.

Skills

Identity-aware authorization

RBAC design

ABAC design

Policy design

Agent-to-agent authorization

Policy-as-code

Zero-trust architecture

A2A protocol depth

Tools

Cedar

OPA

OIDC

OAuth 2.0

JWT inspection

AWS Verified Permissions

MS Entra

AgentCore Policy

Job description

EPAM Systems, Inc. is seeking a Lead Security / Policy Engineer to architect the policy engine, Cedar policy schema, and InfoSec review processes for an enterprise-grade Agent Development Platform.

You will define authorization models for agent-to-agent communication and OAuth/JWT-based identity-aware controls in a cloud-native AWS environment. The role emphasizes default-deny strategies, policy-as-code governance, and staged rollout from observation to enforcement.