Cloud Security / AI Security Engineer, AWS IAM, Cedar Policies

Job not on LinkedIn

🔥 0 minutes ago

🌲 Oregon – Remote

🌲 Oregon – Remote

⏳ Contract/Temporary

🟠 Senior

🔴 Lead

☁️ Cloud Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 10%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

TMS, LLC

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2009

💼 Consulting

🏛️ Government

Consulting • Government

TMS, LLC is a technology management and advisory firm (Technology Management Solutions) that provides IT advisory and consulting, program and project management, financial management, and organizational assessment services. The company works with U. S. federal government clients — including DHS OCIO, FEMA, the National Institute of Mental Health OCIO, and TSA — to improve mission performance, reduce costs, and modernize operations. TMS emphasizes experienced staff, proven processes, mentoring and exercises for system readiness, and cost allocation/charge-back methodologies for transparency and efficiency.

📋 Description

• Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure • Implement RBAC and least-privilege security principles • Define IAM roles, trust policies, permission boundaries, and resource-based policies • Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway • Develop standardized IAM templates for Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch • Automate IAM policy deployment using Terraform, AWS CloudFormation, or AWS CDK • Conduct IAM access reviews, permission audits, and policy validation • Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations • Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy • Implement fine-grained authorization and ABAC for AI agents accessing tools through AgentCore Gateway • Configure policy engines and associate them with AgentCore Gateways • Validate Cedar policies against gateway schemas and test permitted and denied access scenarios • Enforce default-deny authorization and prevent unauthorized tool execution • Monitor and troubleshoot authorization decisions and policy evaluation failures • Implement security controls and standards for enterprise AI agents and Generative AI applications • Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch • Identify and mitigate excessive privileges, credential exposure, unauthorized tool access, and privilege escalation • Conduct security reviews of agent architecture and integrations • Collaborate with AI engineering and DevOps teams on secure production deployments • Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines • Integrate IAM and Cedar policy validation into CI/CD workflows • Implement automated security checks and policy compliance testing • Maintain version-controlled security configurations across environments • Support security incident investigation, access troubleshooting, and remediation

🎯 Requirements

• 15+ years of experience in cloud security and identity management • Experience securing enterprise AI applications on AWS • Experience with AWS IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, and CloudWatch • Experience with Cedar policy language, RBAC, ABAC, and fine-grained access control • Experience with OAuth 2.0, OIDC, JWT, and AWS IAM authentication • Experience with Terraform, AWS CDK, or CloudFormation • Experience with Python, GitHub Actions, and CI/CD security integration • Knowledge of least-privilege access, identity federation, credential management, and secure API integrations • Must be comfortable traveling to client sites for workshops and meetings

🏖️ Benefits

• Remote work • 10% travel to client sites for workshops and meetings • Contract extension possible