Security Engineer with Cedar Policy

Technology stackAWS AgentCore Policy, Cedar, Python, Microsoft Entra ID, OAuth 2.0, JWT, OpenID Connect, Open Policy Agent, AWS AgentCore Gateway, LangGraph, Identity Providers, Audit Logging FrameworksProject overviewThe project focuses on delivering a centralized authorization framework for enterprise AI services and cloud applications. The platform provides secure policy enforcement, identity integration, auditability, and governance capabilities to support scalable and compliant access management across distributed systems.TeamMedium team (10-20 people)You will work with security engineers, backend developers, platform engineers, architects, and governance specialists. The team follows a collaborative development approach, emphasizing policy as code, automation, secure design practices, and continuous improvement.Position overviewWe are looking for a Security Engineer to support the implementation and governance of policy based authorization solutions for enterprise AI and cloud platforms. In this role, you will work with identity, security, and platform teams to develop authorization policies, integrate identity providers, and help build secure access control mechanisms using modern policy frameworks.ResponsibilitiesDevelop and maintain authorization policies using the Cedar policy languageAuthor, test, and validate policy definitions for enterprise applications and AI servicesImplement and support access control models using attribute based and role based authorization approachesConfigure and maintain integrations with identity providers such as Microsoft Entra ID, Okta, and Amazon CognitoMap identity claims and token attributes to authorization decisions and policy rulesSupport the implementation of AWS AgentCore Policy in LOG_ONLY and ENFORCE modesDevelop Python based tooling for policy validation, testing, and automationDesign and implement parameter level access control patterns for secure tool and service interactionsCollaborate with security, platform, and engineering teams to review authorization requirements and implement policy controlsContribute to audit logging and authorization decision traceability practicesSupport security reviews and help maintain authorization governance standardsRequirements3+ years of experience in security engineering, backend engineering, or a related fieldHands on experience integrating enterprise identity providers, including Microsoft Entra ID, Okta, or Amazon CognitoExperience defining and managing policies within an ABAC or RBAC authorization frameworkHands on experience with Open Policy Agent, Cedar, or similar policy based authorization technologiesKnowledge of OAuth 2.0, JWT, OpenID Connect, and modern identity architecturesExperience working with claims mapping and token based authorization modelsUnderstanding of secure authorization design principles and policy lifecycle managementExperience with Python development for automation, validation, or backend servicesStrong analytical and problem solving skillsGood written and verbal communication skillsNice to haveExperience with LangGraph tool invocation patternsExperience integrating with AWS AgentCore GatewayKnowledge of enterprise AI platform architecture and governance principlesExperience implementing policy as code methodologiesFamiliarity with cloud native security services and authorization platformsExposure to audit logging and compliance reporting requirementsWhat We Offer:Vacation days: Up to 26 business days per year.10 illness/special days off per year (fully paid, no medical papers needed) for all contract typesHealth and life insurance (Luxmed)MyBenefit platform with Multisport optionInternal psychological support serviceEnglish language classes from the first working dayAccess to external learning platforms: O’Reilly, LinkedIn Learning, Udemy, and a wide catalog of diverse internal trainingFlexible workplace: work from the office, from home, or choose a hybrid optionTech Skills Mentoring ProgramOpportunities to develop as a public speaker, mentor, or technical interviewerFully paid idle (bench) when not involved in a projectCertification reimbursement (AWS, GCP, Microsoft, etc.)