Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years
TMS LLC · Oregon, United States · remote
Role: Cloud Security Engineer / AI Security Engineer
Location: Los Angeles, CA (Remote – 10% Travel; must be comfortable traveling to client sites for workshops and meetings)
Duration: 3+ Months (Extension Possible)
💼 Experience: 15+ Years
Primary Skills: IAM Policy Templates, Cedar Policies
Role Overview:
Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources.
Key Responsibilities
1. IAM Policy Templates & Access Management
- Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
- Implement role-based access control (RBAC) and least-privilege security principles.
- Define IAM roles, trust policies, permission boundaries, and resource-based policies.
- Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
- Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
- Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
- Conduct IAM access reviews, permission audits, and policy validation.
- Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.
2. Cedar Policies at AgentCore Gateway
- Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
- Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
- Define policies specifying which identities can invoke particular tools, APIs, and operations.
- Configure policy engines and associate them with AgentCore Gateways.
- Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
- Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
- Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
- Enforce default-deny authorization and prevent unauthorized tool execution.
- Monitor and troubleshoot authorization decisions and policy evaluation failures.
3. Security Governance & Compliance
- Implement security controls for enterprise AI agents and Generative AI applications.
- Develop security standards for agent identities, API integrations, and access management.
- Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
- Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
- Conduct security reviews of agent architecture and integrations.
- Collaborate with AI engineering and DevOps teams to ensure secure production deployments.
4. Security Automation & DevSecOps
- Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
- Integrate IAM and Cedar policy validation into CI/CD workflows.
- Implement automated security checks and policy compliance testing.
- Maintain version-controlled security configurations across development, testing, and production environments.
- Support security incident investigation, access troubleshooting, and remediation.
Required Technical Skills
- AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
- Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
- Authentication: OAuth 2.0, OIDC, JWT, AWS IAM authentication.
- Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
- Automation: Python, GitHub Actions, CI/CD security integration.
- Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.
All your information will be kept confidential according to EEO guidelines.