Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

Technology Management Solutions LLC; Oregon; Hybrid; USD 120,000 - 180,000; Part time

Job summary

Technology Management Solutions LLC seeks an experienced Cloud Security/AI Security Engineer to secure enterprise AI applications on AWS. The role emphasizes authentication, reusable IAM policy templates, and Cedar-based authorization for secure access to tools, APIs, and enterprise resources; occasional client-site workshops will require travel.

The candidate should bring 15+ years of cloud security experience, proficiency in RBAC/ABAC, IaC, and CI/CD security, with a strong focus on secure

Qualifications

• 15+ years of experience in cloud security and identity management.
• Experience with authentication, IAM templates, and Cedar-based authorization.

Responsibilities

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and infrastructure.
• Implement RBAC and least-privilege security.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and Gateway.
• Develop standardized IAM templates for AWS services (Lambda, S3, Bedrock, API Gateway, Secrets Manager, CloudWatch).
• Automate IAM policy deployment using IaC tools.
• Conduct access reviews and audits.
• Troubleshoot access-denied issues and misconfigurations.
• Design, author, test Cedar authorization policies for AgentCore Gateway.
• Implement ABAC with identities, roles, scopes, and context.
• Define policy engines and associate with Gateways.
• Validate Cedar policies and ensure default-deny behavior.

Skills

AWS IAM

Cedar policies

RBAC

ABAC

Terraform

CloudFormation

CDK

Python

GitHub Actions

CI/CD security

CloudWatch

CloudTrail

Tools

Terraform

AWS CDK

CloudFormation

GitHub Actions

Job description

Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

• Contract

Location: Los Angeles, CA(Remote – 10% Travel; must be comfortable traveling to client sites for workshops and meetings)

Duration: 3+ Months (Extension Possible)

Primary Skills: IAM Policy Templates, Cedar Policies

Role Overview

Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources.

Key Responsibilities

1. IAM Policy Templates & Access Management

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
• Implement role-based access control (RBAC) and least-privilege security principles.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
• Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
• Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
• Conduct IAM access reviews, permission audits, and policy validation.
• Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

2. Cedar Policies at AgentCore Gateway

• Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
• Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
• Define policies specifying which identities can invoke particular tools, APIs, and operations.
• Configure policy engines and associate them with AgentCore Gateways.
• Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
• Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
• Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
• Enforce default-deny authorization and prevent unauthorized tool execution.
• Monitor and troubleshoot authorization decisions and policy evaluation failures.

3. Security Governance & Compliance

• Implement security controls for enterprise AI agents and Generative AI applications.
• Develop security standards for agent identities, API integrations, and access management.
• Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
• Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
• Conduct security reviews of agent architecture and integrations.
• Collaborate with AI engineering and DevOps teams to ensure secure production deployments.

4. Security Automation & DevSecOps

• Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
• Integrate IAM and Cedar policy validation into CI/CD workflows.
• Implement automated security checks and policy compliance testing.
• Maintain version-controlled security configurations across development, testing, and production environments.
• Support security incident investigation, access troubleshooting, and remediation.

Required Technical Skills

• AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
• Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
• Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
• Automation: Python, GitHub Actions, CI/CD security integration.
• Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.

All your information will be kept confidential according to EEO guidelines.