Policy Engineer – AI Agent Authorization & Cloud Security

Policy Engineer – AI Agent Authorization & Cloud Security About the Role We are looking for a Policy Engineer to design, implement, test, and validate fine-grained authorization policies for AI agent platforms and cloud-native services. The role focuses on Cedar policy development, identity provider integrations, policy enforcement, attribute-based access control (ABAC), and policy-as-code. The ideal candidate combines hands-on security or backend engineering experience with strong Python skills and a solid understanding of modern authorization architectures, identity, access control, and distributed cloud platforms. Project Overview Our customer is a multinational corporation with more than a century of history, operating across 180+ countries and serving more than 1 billion consumers worldwide. The organisation is pursuing an ambitious strategy to introduce a new generation of Reduced-Risk Products (RRPs), supported by a large-scale digital and technology ecosystem comprising 700+ applications. Intellia's mission is to support the client in engineering a comprehensive software ecosystem for a game-changing IoT product, combining innovative consumer experiences with cutting-edge technology. Our teams are responsible for engineering core platform components supporting best-in-class eCommerce, Digital Marketing, and IoT solutions. As a Policy Engineer, you will join the Core Architecture Team and contribute to the architecture, implementation, and adoption of security and authorization best practices across the Digital Engineering Enterprise Platform. The platform provides engineering teams with reusable services, technologies, and practices that accelerate software development and delivery while addressing common SDLC, security, compliance, governance, and operational challenges. Key Responsibilities Design, implement, and maintain fine-grained authorization policies using the Cedar policy language. Author, test, validate, and troubleshoot Cedar policy definitions. Configure and manage AWS AgentCore Policy in both LOG_ONLY and ENFORCE modes. Develop Python-based tooling for: Policy validation Automated policy testing Policy governance Policy quality checks Authorization decision validation Integrate authorization frameworks with Microsoft Entra ID and other identity providers. Design and implement claims mapping between identity providers and authorization policies. Develop token-based authorization flows using OAuth 2.0 and JWT. Implement fine-grained and parameter-level access control patterns. Design and maintain ABAC and RBAC authorization models for cloud-native services and AI agents. Define authorization policies for distributed systems and AI agent platforms. Develop policy enforcement mechanisms and validation workflows. Establish auditability and traceability for authorization decisions. Support the adoption of policy-as-code practices across engineering teams. Partner with platform engineering, security, architecture, and application teams to ensure consistent access governance. Review existing authorization models and identify opportunities to improve security, maintainability, and scalability. Contribute to authorization architecture standards, reusable patterns, and engineering best practices. Ensure authorization implementations meet enterprise security, compliance, and governance requirements. Required Skills & Experience Authorization & Policy Engineering Hands-on experience with Cedar policy language, including policy authoring and testing. Practical experience with ABAC and/or RBAC authorization systems. Hands-on experience with Open Policy Agent (OPA) or Cedar. Understanding of fine-grained authorization and policy-as-code concepts. Experience designing authorization policies for distributed or cloud-native applications. AWS AgentCore Hands-on experience with AWS AgentCore Policy. Understanding and practical experience using LOG_ONLY and ENFORCE modes. Ability to design, test, troubleshoot, and validate AgentCore authorization policies. Python Strong Python development skills. Experience developing tooling for policy validation, testing, automation, or security engineering. Ability to build maintainable and testable Python components. Identity & Access Management Experience integrating with identity providers such as: Microsoft Entra ID Okta Amazon Cognito Similar enterprise identity platforms Strong understanding of identity claims and token-based authorization. Experience with OAuth 2.0 and JWT. Experience implementing claims mapping between identity providers and authorization systems. Fine-Grained Authorization Experience implementing parameter-level access control. Understanding of contextual authorization and attribute-based access decisions. Ability to translate business/security requirements into enforceable authorization policies. Professional Experience 3+ years of experience in security engineering, backend engineering, authorization engineering, or a closely related discipline. Demonstrable hands-on experience with identity provider integration. Experience implementing policy definitions using an ABAC or RBAC authorization system. Hands-on experience with OPA or Cedar. Nice to Have Experience with LangGraph and AI agent tool-invocation patterns. Experience integrating AWS AgentCore Gateway. Experience securing AI agents and agentic workflows. Familiarity with cloud-native security architectures. Experience with authorization for microservices and distributed systems. Experience with automated policy testing and policy CI/CD pipelines. Knowledge of security governance, audit, and authorization observability. Key Technical Skills Must Have: Cedar AWS AgentCore Policy LOG_ONLY / ENFORCE Python Microsoft Entra ID Claims Mapping OAuth 2.0 JWT ABAC / RBAC Fine-Grained Authorization Parameter-Level Access Control OPA or Cedar Nice to Have: LangGraph AWS AgentCore Gateway AI Agent Security Policy-as-Code Cloud-Native Security Autho