Lead Agent Identity Engineer

EPAM Systems; United States; On-site; USD 140,000 - 190,000; Full time

Job summary

EPAM Systems Inc. is seeking a Lead Agent Identity Engineer to own runtime identity and access control for our cloud-native Enterprise Agent Development Platform.

You will design token exchange, enforce secure authentication, and integrate identity across agent-to-tool-to-API chains on AWS. You will collaborate with security and platform teams, implement OBO flows, manage vaults, and ensure compliant identity governance across the agent ecosystem.

Qualifications

• 5+ years of experience in cloud security or identity engineering.
• Hands-on experience with AI agent identity in production environments (OBO token exchange).
• Expertise with AWS Bedrock AgentCore Identity or equivalent technology (inbound/outbound auth, token vault).
• Hands-on with OAuth 2.0, OIDC, and JWT (issuance, validation, exchange).
• Experience with On-Behalf-Of/token-exchange flows in production (RFC 8693).
• Background in enterprise identity federation (MS Entra, Okta, Cognito).
• Knowledge of secret management and token lifecycle, including rotation and vaulting.
• English proficiency at B2 level or higher.

Responsibilities

• Own runtime identity and access control for the agent platform, including inbound and outbound auth.
• Design and implement On-Behalf-Of (OBO) token exchange and scoped identity propagation across agent tool API chains.
• Integrate identity into the agent invocation lifecycle within AgentCore Runtime.
• Manage Gateway outbound authorization and per-target credentials, ensuring secrets are never exposed to the calling agent.
• Build and maintain token vault and workload identity brokering capabilities.
• Coordinate Cedar / MS Entra claims mapping for identity-aware authorization with Runtime Controls.
• Validate claims, scopes, audience, and issuer for JWT / OAuth 2.0 / OIDC tokens, including short-lived scoped tokens.
• Partner with platform and security teams to enforce consistent identity governance across the agent ecosystem.

Skills

Cloud security

Identity engineering

OBO token exchange

OAuth 2.0 / OIDC

JWT handling

AgentCore Identity

Identity federation

Token lifecycle management

English proficiency (B2)

Tools

AWS Bedrock AgentCore Identity

MS Entra / Entra ID

Okta

Cognito

Job description

We are looking for a Lead Agent Identity Engineer to own runtime identity and access control for an Enterprise Agent Development Platform — a production-grade, cloud-native ecosystem that enables engineering teams to define, orchestrate, deploy, and observe AI agents at scale. The role covers inbound and outbound auth, on-behalf-of token exchange, and enterprise identity federation across agent to tool to API chains, using LangGraph and Strands Agents on AWS AgentCore Runtime.

Responsibilities

• Own runtime identity and access control for the agent platform, including inbound and outbound auth
• Design and implement On-Behalf-Of (OBO) token exchange and scoped identity propagation across agent tool API chains
• Integrate identity into the agent invocation lifecycle within AgentCore Runtime
• Manage Gateway outbound authorization and per-target credentials, ensuring secrets are never exposed to the calling agent
• Build and maintain token vault and workload identity brokering capabilities
• Coordinate Cedar / MS Entra claims mapping for identity-aware authorization with Runtime Controls
• Validate claims, scopes, audience, and issuer for JWT / OAuth 2.0 / OIDC tokens, including short-lived scoped tokens
• Partner with platform and security teams to enforce consistent identity governance across the agent ecosystem

Requirements

• 5+ years of experience in cloud security or identity engineering
• Hands-on experience with identity and access control specifically for AI agents in a production agentic AI project, such as On-Behalf-Of (OBO) token exchange across agent-to-tool-to-API chains, AgentCore Identity, or agent identity federation (Entra Agent ID)
• Expertise in AWS Bedrock AgentCore Identity or similar technology, including inbound auth, outbound auth, and token vault
• Hands-on implementation experience with OAuth 2.0, OIDC, and JWT, including token issuance, validation, and exchange
• Experience with On-Behalf-Of / token-exchange flows in production (RFC 8693 or equivalent)
• Background in enterprise identity federation with MS Entra, Okta, or Cognito
• Skills in secure credential / secret management and token lifecycle, including rotation and vaulting
• English proficiency at B2 level or higher
• Nice to have Showcase of AWS Bedrock AgentCore Identity early adoption or equivalent experience
• Familiarity with AWS AgentCore Gateway outbound-auth integration
• Knowledge of MCP / A2A tool-invocation auth patterns
• Exposure to AgentCore Policy (Cedar) or AWS Verified Permissions