Senior Agent Identity Architect for AI Platform

EPAM Systems; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

EPAM Systems Inc. is seeking a Lead Agent Identity Engineer to own runtime identity and access control for our cloud-native Enterprise Agent Development Platform.

You will design token exchange, enforce secure authentication, and integrate identity across agent-to-tool-to-API chains on AWS. You will collaborate with security and platform teams, implement OBO flows, manage vaults, and ensure compliant identity governance across the agent ecosystem.

Qualifications

• 5+ years of experience in cloud security or identity engineering.
• Hands-on experience with AI agent identity in production environments (OBO token exchange).
• Expertise with AWS Bedrock AgentCore Identity or equivalent technology (inbound/outbound auth, token vault).
• Hands-on with OAuth 2.0, OIDC, and JWT (issuance, validation, exchange).
• Experience with On-Behalf-Of/token-exchange flows in production (RFC 8693).
• Background in enterprise identity federation (MS Entra, Okta, Cognito).
• Knowledge of secret management and token lifecycle, including rotation and vaulting.
• English proficiency at B2 level or higher.

Responsibilities

• Own runtime identity and access control for the agent platform, including inbound and outbound auth.
• Design and implement On-Behalf-Of (OBO) token exchange and scoped identity propagation across agent tool API chains.
• Integrate identity into the agent invocation lifecycle within AgentCore Runtime.
• Manage Gateway outbound authorization and per-target credentials, ensuring secrets are never exposed to the calling agent.
• Build and maintain token vault and workload identity brokering capabilities.
• Coordinate Cedar / MS Entra claims mapping for identity-aware authorization with Runtime Controls.
• Validate claims, scopes, audience, and issuer for JWT / OAuth 2.0 / OIDC tokens, including short-lived scoped tokens.
• Partner with platform and security teams to enforce consistent identity governance across the agent ecosystem.

Skills

Cloud security

Identity engineering

OBO token exchange

OAuth 2.0 / OIDC

JWT handling

AgentCore Identity

Identity federation

Token lifecycle management

English proficiency (B2)

Tools

AWS Bedrock AgentCore Identity

MS Entra / Entra ID

Okta

Cognito

Job description

EPAM Systems Inc. is seeking a Lead Agent Identity Engineer to own runtime identity and access control for our cloud-native Enterprise Agent Development Platform.

You will design token exchange, enforce secure authentication, and integrate identity across agent-to-tool-to-API chains on AWS. You will collaborate with security and platform teams, implement OBO flows, manage vaults, and ensure compliant identity governance across the agent ecosystem.