Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies |Remote | 15+ Years

TMS LLC; Salem (OR); Híbrido; USD 150.000 - 210.000; Tempo integral

Resumo da vaga

Technology Management Solutions LLC in Los Angeles, CA is seeking a Cloud Security Engineer focused on AI security for enterprise AWS environments. You will design and enforce IAM and Cedar-based authorization for AI agents and AgentCore infrastructure.

The role emphasizes secure authentication, policy automation with IaC, and collaboration with AI engineering and DevOps to ensure compliant, secure production deployments.

Qualificações

• 15+ years of experience in cloud security and identity management.
• Experience with AWS IAM, STS, Secrets Manager, CloudTrail, CloudWatch.
• Proficiency with Cedar policy language, RBAC and ABAC.

Responsabilidades

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
• Implement RBAC and least-privilege security principles.
• Define IAM roles, trust policies, permission boundaries, and resource-based policies.
• Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
• Develop standardized IAM templates for AWS services (Lambda, S3, Bedrock, API Gateway, Secrets Manager, CloudWatch).
• Automate IAM policy deployment and configuration using Terraform, CloudFormation, or AWS CDK.
• Conduct IAM access reviews, permission audits, and policy validation.
• Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.
• Design, author, test Cedar authorization policies for AgentCore Gateway.
• Implement ABAC using identity attributes, roles, and contextual conditions.
• Develop policies to restrict sensitive tool operations based on roles and security requirements.

Conhecimentos

AWS IAM

RBAC

ABAC

OIDC

JWT

Terraform

CloudFormation

CDK

Python

GitHub Actions

CI/CD Security

Cedar policy

Ferramentas

Bedrock

Descrição da vaga

Job Description

Role: Cloud Security Engineer / AI Security Engineer

Location: Los Angeles, CA (Remote – 10% Travel; must be comfortable traveling to client sites for workshops and meetings)

Duration: 3+ Months (Extension Possible)

Experience: 15+ Years

Primary Skills: IAM Policy Templates, Cedar Policies

Role Overview

Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources.

Key Responsibilities

1. IAM Policy Templates & Access Management

   • Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
   • Implement role-based access control (RBAC) and least-privilege security principles.
   • Define IAM roles, trust policies, permission boundaries, and resource-based policies.
   • Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
   • Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
   • Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
   • Conduct IAM access reviews, permission audits, and policy validation.
   • Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

2. Cedar Policies at AgentCore Gateway

   • Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
   • Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
   • Define policies specifying which identities can invoke particular tools, APIs, and operations.
   • Configure policy engines and associate them with AgentCore Gateways.
   • Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
   • Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
   • Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
   • Enforce default-deny authorization and prevent unauthorized tool execution.
   • Monitor and troubleshoot authorization decisions and policy evaluation failures.

3. Security Governance & Compliance

   • Implement security controls for enterprise AI agents and Generative AI applications.
   • Develop security standards for agent identities, API integrations, and access management.
   • Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
   • Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
   • Conduct security reviews of agent architecture and integrations.
   • Collaborate with AI engineering and DevOps teams to ensure secure production deployments.

4. Security Automation & DevSecOps

   • Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
   • Integrate IAM and Cedar policy validation into CI/CD workflows.
   • Implement automated security checks and policy compliance testing.
   • Maintain version-controlled security configurations across development, testing, and production environments.
   • Support security incident investigation, access troubleshooting, and remediation.

Required Technical Skills

• AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
• Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
• Authentication: OAuth 2.0, OIDC, JWT, AWS IAM authentication.
• Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
• Automation: Python, GitHub Actions, CI/CD security integration.
• Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.

Additional Information

All your information will be kept confidential according to EEO guidelines.