Senior AI Agent Identity Architect (OBO & Federation)

Intellias; Polska; On-site; PLN 180,000 - 300,000; Full time

Job summary

Intellias is seeking a Senior Identity & Access Management Engineer to design and implement secure identity propagation across AI agent ecosystems. You will focus on runtime identity, On-Behalf-Of token exchange, and identity federation.

You will work on OAuth 2.0, OIDC, JWT validation, and policy-based access control, integrating enterprise providers like MS Entra, Okta, or Cognito to secure agent-to-tool and agent-to-API interactions.

Qualifications

• 5+ years of cloud security or identity engineering.
• On-Behalf-Of / token-exchange flows in production.
• Enterprise identity federation with MS Entra, Okta, or Cognito.
• Secure credential/secret management and token lifecycle.

Responsibilities

• Design secure identity propagation across agent → tool → API chains.
• Build and support OBO token exchange flows and scoped delegation.
• Integrate AWS Bedrock AgentCore Identity into agent runtime workflows.
• Implement OAuth 2.0, OpenID Connect (OIDC), and JWT-based authentication/authorization.
• Develop identity federation integrations with MS Entra ID, Okta, or Amazon Cognito.
• Configure gateway-level outbound authorization and credential management.
• Build secure token issuance, validation, exchange, rotation, lifecycle management.
• Design workload identity brokering and agent identity mapping mechanisms.
• Implement identity-aware authorization using Cedar policies and claims mapping.
• Collaborate with platform, security, and runtime teams to align identity controls.
• Support secure A2A and A2T invocation authorization patterns.
• Participate in security reviews, threat modeling, and architecture discussions.

Skills

AWS Bedrock AgentCore Identity

On-Behalf-Of token exchange

JWT / OAuth 2.0 / OIDC

Identity federation

Gateway outbound authorization

AgentCore Runtime integration

Cedar / Entra claims mapping

Job description

Intellias is seeking a Senior Identity & Access Management Engineer to design and implement secure identity propagation across AI agent ecosystems. You will focus on runtime identity, On-Behalf-Of token exchange, and identity federation.

You will work on OAuth 2.0, OIDC, JWT validation, and policy-based access control, integrating enterprise providers like MS Entra, Okta, or Cognito to secure agent-to-tool and agent-to-API interactions.