LA-Based Cloud & AI Security Engineer (Bedrock/IAM)

Tap Growth ai; Los Angeles (CA); On-site; USD 120,000 - 180,000; Full time

Job summary

Tap Growth ai is seeking a Cloud Security Engineer to design and manage security frameworks for AI applications built on AWS Bedrock AgentCore in Los Angeles, CA. The role emphasizes secure identity management, IAM templates, and Cedar-based authorization across agents, tools, APIs, and enterprise integrations.

You will implement authentication patterns (OAuth2/OIDC/JWT), integrate with Cognito/Entra/Okta, and drive policy governance with RBAC/ABAC within a secure Bedrock Gateway environment.

Qualifications

• Experience designing secure identity and authentication for enterprise AI workloads.
• Strong knowledge of IAM, RBAC/ABAC, and Cedar policies.
• Proficiency with Bedrock AgentCore components and integrations.

Responsibilities

• Design and implement secure identity using Bedrock AgentCore Identity.
• Configure authentication for AI agents and internal tools via OAuth/OIDC/JWT.
• Create reusable IAM templates for Lambda, S3, Bedrock, API Gateway, and Secrets Manager.
• Automate policy deployment with Terraform, CloudFormation, or CDK.
• Develop Cedar authorization policies for AgentCore Gateway and ABAC controls.
• Ensure least-privilege access and auditability with CloudTrail/CloudWatch.

Skills

AWS IAM

AgentCore Identity

AgentCore Gateway

Cedar policy

RBAC

ABAC

OAuth 2.0

OIDC

JWT

CloudWatch

Tools

Terraform

AWS CDK

CloudFormation

CloudWatch

Secrets Manager

CloudTrail

Cognito

Job description

Tap Growth ai is seeking a Cloud Security Engineer to design and manage security frameworks for AI applications built on AWS Bedrock AgentCore in Los Angeles, CA. The role emphasizes secure identity management, IAM templates, and Cedar-based authorization across agents, tools, APIs, and enterprise integrations.

You will implement authentication patterns (OAuth2/OIDC/JWT), integrate with Cognito/Entra/Okta, and drive policy governance with RBAC/ABAC within a secure Bedrock Gateway environment.