Agent identity engineer

Intellias; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Intellias is seeking a Senior Identity & Access Management Engineer to design and implement secure identity propagation and authorization patterns across AI agent ecosystems. The role focuses on runtime identity, OBO token exchange, identity federation, and secure agent-to-tool communication using AWS Bedrock AgentCore and modern enterprise identity platforms.

Responsibilities include building OBO flows, integrating Bedrock Identity, and enforcing Cedar-based access controls with MS Entra, Okta,

Qualifications

• 5+ years cloud security or identity engineering
• Hands-on OAuth 2.0 / OIDC / JWT implementation
• Enterprise identity federation with MS Entra, Okta, or Cognito

Responsibilities

• Design and implement secure identity propagation across agent → tool → API chains.
• Build and support OBO token exchange flows and scoped identity propagation.
• Integrate AWS Bedrock AgentCore Identity into agent runtime workflows.
• Implement OAuth 2.0, OIDC, and JWT-based auth patterns.
• Develop identity federation integrations with enterprise providers like MS Entra ID, Okta, or Cognito.

Skills

OBO token exchange

Identity propagation

Identity federation

OAuth 2.0 / OIDC / JWT

Workload identity brokering

Credential management

Tools

AWS Bedrock AgentCore Identity

MS Entra ID

Okta

Cognito

Cedar policies / Cedar runtime

AWS Verified Permissions

Job description

Описание

We are looking for a Senior Identity & Access Management Engineer to design and implement secure identity propagation and authorization patterns across AI agent ecosystems. The role focuses on runtime identity, On-Behalf-Of (OBO) token exchange, identity federation, and secure agent-to-tool communication using AWS Bedrock AgentCore and modern enterprise identity platforms.

Задачи

• Design and implement secure identity propagation across agent → tool → API interaction chains.
• Build and support On-Behalf-Of (OBO) token exchange flows and scoped delegation mechanisms.
• Integrate AWS Bedrock AgentCore Identity capabilities into agent runtime workflows.
• Implement OAuth 2.0, OpenID Connect (OIDC), and JWT-based authentication and authorization patterns.
• Develop identity federation integrations with enterprise identity providers such as Microsoft Entra ID, Okta, or Amazon Cognito.
• Configure gateway-level outbound authorization and per-target credential management, ensuring sensitive credentials are never exposed to calling agents.
• Build secure token issuance, validation, exchange, rotation, and lifecycle management processes.
• Design and implement workload identity brokering and agent identity mapping mechanisms.
• Implement identity-aware authorization controls using Cedar policies, claims mapping, and fine-grained access enforcement.
• Collaborate with platform, security, and runtime teams to align identity controls with enterprise security standards.
• Support secure agent-to-agent (A2A) and agent-to-tool invocation authorization patterns.
• Participate in security reviews, threat modeling, and architecture discussions related to AI agent platforms.
• Define and enforce best practices for runtime identity, federated access, delegated authorization, and credential protection.

Требования

• AWS Bedrock AgentCore Identity or similar technology (inbound auth, outbound auth, token vault)
• On-Behalf-Of (OBO) token exchange and scoped identity propagation across agent → tool → API chains
• JWT / OAuth 2.0 / OIDC (claims, scopes, audience/issuer validation, short-lived scoped tokens)
• Identity federation and MS Entra Agent ID integration or similar technology (workload identity brokering)
• Gateway outbound authorization and per-target credential management (secrets never exposed to the calling agent)
• AgentCore Runtime integration of identity into the agent invocation lifecycle
• Cedar / MS Entra claims mapping for identity-aware authorization (coordination with Runtime Controls)
• 5+ years cloud security or identity engineering
• Hands-on OAuth 2.0 / OIDC / JWT implementation (token issuance, validation, exchange)
• On-Behalf-Of / token-exchange flows in production (RFC 8693 or equivalent)
• Enterprise identity federation with MS Entra, Okta, or Cognito
• Secure credential/secret management and token lifecycle (rotation, vaulting)
• Будет плюсом: AWS Bedrock AgentCore Identity early adopter or equivalent; AWS AgentCore Gateway outbound-auth integration; MCP / A2A tool-invocation auth patterns; AgentCore Policy (Cedar) or AWS Verified Permissions exposure

Условия

At Intellias, where technology takes center stage, people always come before processes. By creating a comfortable atmosphere in our team, we empower individuals to unlock their true potential and achieve extraordinary results. That’s why we offer a range of benefits that support your well-being and charge your professional growth.