Cloud Security Engineer / AI Security Engineer

Tap Growth ai; Los Angeles (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Tap Growth ai is seeking a Cloud Security Engineer to design and manage security frameworks for AI applications built on AWS Bedrock AgentCore in Los Angeles, CA. The role emphasizes secure identity management, IAM templates, and Cedar-based authorization across agents, tools, APIs, and enterprise integrations.

You will implement authentication patterns (OAuth2/OIDC/JWT), integrate with Cognito/Entra/Okta, and drive policy governance with RBAC/ABAC within a secure Bedrock Gateway environment.

Qualifications

• Experience designing secure identity and authentication for enterprise AI workloads.
• Strong knowledge of IAM, RBAC/ABAC, and Cedar policies.
• Proficiency with Bedrock AgentCore components and integrations.

Responsibilities

• Design and implement secure identity using Bedrock AgentCore Identity.
• Configure authentication for AI agents and internal tools via OAuth/OIDC/JWT.
• Create reusable IAM templates for Lambda, S3, Bedrock, API Gateway, and Secrets Manager.
• Automate policy deployment with Terraform, CloudFormation, or CDK.
• Develop Cedar authorization policies for AgentCore Gateway and ABAC controls.
• Ensure least-privilege access and auditability with CloudTrail/CloudWatch.

Skills

AWS IAM

AgentCore Identity

AgentCore Gateway

Cedar policy

RBAC

ABAC

OAuth 2.0

OIDC

JWT

CloudWatch

Tools

Terraform

AWS CDK

CloudFormation

CloudWatch

Secrets Manager

CloudTrail

Cognito

Job description

We're Hiring: Cloud Security Engineer / AI Security Engineer!

Primary Skills

AWS Bedrock AgentCore Identity, IAM Policy Templates, Cedar Policies, AgentCore Gateway

Duration

3+ Months with possible extension

Location

Los Angeles, CA (Local to CA or LA only)

Job Summary

We are seeking an experienced Security Engineer to design, implement, and manage security frameworks for enterprise Agentic AI applications built on AWS Bedrock AgentCore.

The ideal candidate will have strong expertise in AgentCore Identity, AWS Identity and Access Management (IAM), and Cedar-based fine-grained authorization policies to secure AI agents, tools, APIs, and enterprise integrations.

This role focuses on implementing secure identity management, reusable IAM policy templates, and policy-based access control at the Amazon Bedrock AgentCore Gateway.

Key Responsibilities

1. Amazon Bedrock AgentCore Identity & Authentication

• Design and implement secure identity and authentication solutions using Amazon Bedrock AgentCore Identity.
• Configure inbound and outbound authentication for AI agents accessing enterprise applications, tools, and external APIs.
• Implement OAuth 2.0, OpenID Connect (OIDC), JWT-based authentication, and AWS IAM-based authentication.
• Integrate AgentCore Identity with identity providers such as Amazon Cognito, Microsoft Entra ID, or Okta.
• Configure secure token management, credential handling, and access delegation.
• Implement secure agent-to-agent, agent-to-tool, and agent-to-API access patterns.
• Ensure that agents operate within appropriate identity boundaries and cannot access unauthorized enterprise resources.

2. IAM Policy Templates & Access Management

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
• Implement role-based access control (RBAC) and least-privilege security principles.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
• Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
• Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
• Conduct IAM access reviews, permission audits, and policy validation.
• Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

3. Cedar Policies at AgentCore Gateway

• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
• Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
• Define policies specifying which identities can invoke particular tools, APIs, and operations.
• Configure policy engines and associate them with AgentCore Gateways.
• Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
• Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
• Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
• Enforce default-deny authorization and prevent unauthorized tool execution.
• Monitor and troubleshoot authorization decisions and policy evaluation failures.

4. Security Governance & Compliance

• Implement security controls for enterprise AI agents and Generative AI applications.
• Develop security standards for agent identities, API integrations, and access management.
• Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
• Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
• Conduct security reviews of agent architecture and integrations.
• Collaborate with AI engineering and DevOps teams to ensure secure production deployments.

5. Security Automation & DevSecOps

• Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
• Integrate IAM and Cedar policy validation into CI/CD workflows.
• Implement automated security checks and policy compliance testing.
• Maintain version-controlled security configurations across development, testing, and production environments.
• Support security incident investigation, access troubleshooting, and remediation.

Required Technical Skills

• AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
• AgentCore Security: AgentCore Identity, AgentCore Gateway, AgentCore Policy.
• Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
• Authentication: OAuth 2.0, OIDC, JWT, AWS IAM authentication.
• Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
• Automation: Python, GitHub Actions, CI/CD security integration.
• Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.