Platform (Security) Engineer – Agentic Security & Enforcement

We are looking for a Platform Engineer specializing in Agentic Security & Enforcement to help build the security foundation of an enterprise AI Agent Platform from the ground up. The role will focus on protecting agent-to-tool and agent-to-agent interactions through strong authorization, identity, credential management, and gateway enforcement mechanisms.
You will work on establishing zero-trust security patterns for AI agents, ensuring that agents can access only authorized tools and resources while credentials remain securely managed outside of the agent environment.

Our client is a large global enterprise operating across multiple markets, with a complex technology landscape and a strong focus on digital transformation and innovation. The organization is actively investing in modern cloud, data, and AI capabilities to enable scalable, secure, and highly automated solutions across its business.

The project is focused on building an enterprise-grade AI Agent Platform from the ground up. The platform will provide a standardized foundation for developing, deploying, orchestrating, securing, and observing AI agents across multiple teams and use cases.

The initiative covers the full agent lifecycle and brings together agent orchestration, observability, security, governance, integrations, evaluation, and platform engineering. Engineers joining the project will have an opportunity to influence key architectural and technical decisions and contribute to a new platform rather than maintaining an existing solution.

• Design and implement authorization mechanisms for agent-to-tool interactions, including tool-level access control.
• Define and enforce Cedar-based policies governing agent permissions and tool access.
• Implement secure agent identity and authentication, including JWT validation and service-to-service trust.
• Design credential management patterns for OAuth tokens, API keys, and AWS IAM roles, ensuring credentials are never exposed directly to agents.
• Implement secure storage and rotation of per-tool and per-target credentials using AWS secrets management capabilities.
• Enforce gateway-based access patterns to prevent agents from bypassing security controls and directly accessing protected tools.
• Implement security controls for MCP tool invocation, including authentication and authorization.
• Build auditability capabilities for agent workflows, tool invocations, and agent-to-agent interactions.
• Support security tracing and observability across agent workflows.
• Contribute to zero-trust architecture and security standards for the AI Agent Platform.
• Collaborate with platform and engineering teams to embed security controls into agent integration and execution flows.

• Agentic authorization — Cedar policy engine for agent-to-tool permissions, tool-level access control

• Agent credential management — per-tool OAuth tokens, API keys, IAM roles (never exposed to agents)

• Agent identity — JWT validation, cross-agent authentication, service-to-service trust

• Agentic audit — tracing agent workflows, tool invocation logging, agent-to-agent interaction tracking

• Gateway enforcement — ensuring agents cannot bypass the gateway to reach tools directly

• AWS secrets management — per-target credential storage and rotation

• 4+ years security engineering in AI/ML or agent platforms

• Implemented authorization systems for API or tool access

• Credential management and secret rotation patterns

• Agent workflow observability and tracing

• Cedar policy language or OPA for agent authorization

• AWS Bedrock AgentCore policy configuration

• Agent-to-agent authentication patterns

• Zero-trust architecture for agentic systems

• MCP protocol security (authentication, authorization at tool invocation)