AI / Agentic Identity Engineer-W2 only

About the role

We are seeking a senior-level Security Engineer to support a strategic initiative to establish an identity and access management (IAM) program for AI agents; treating each agent as a governed non-human identity (NHI) with a tracked owner, a pre-approved permission set (persona), and strong workload identity. This includes both consumer-facing and internal agentic services. This role sits at the intersection of agentic AI security, identity and access management, and large-scale application security. The engineer will help design and operationalize runtime guardrails, identity-aware authorization, and policy enforcement across both guest-facing and internal systems. This is not a traditional application security role. The ideal candidate is comfortable securing non-deterministic systems, tool-calling agents, and identity-driven control planes, while grounding solutions in proven web, API, and edge-security principles.

Engagement objectives & Key Responsibilities

• Design and implement security control planes for agentic AI systems
• Define runtime authorization boundaries for AI agents, including tool-level access control and least-privilege execution
• Establish policy enforcement points governing agent behavior prior to high-impact actions
• Support human-in-the-loop workflows for sensitive or high-risk AI-initiated actions
• Design persona / agent data models (agents, personas, pre-approved permission sets, ownership, recertification)
• Integrate agent registry with our IdPs, agent build platforms, and secrets/credential management
• Ensure end-to-end attribution across user agent tool execution chains
• Implement SPIFFE/SPIRE (or equivalent) for cryptographic agent identity
• Implement OAuth 2.0/2.1, OIDC, On-Behalf-Of (RFC 8693) token exchange, and audience-bound tokens (RFC 8707); enforce least privilege and temporal / just-in-time constraints
• Build or configure connectors to discover and govern agents across on-premises and multi-cloud environments
• Apply identity/authorization patterns for Model Context Protocol (MCP) and Agent2Agent (A2A) interactions (audience binding, no token pass-through, delegation)
• Collaborate on edge security controls including WAFs, bot mitigation, and API gateways
• Ensure consistent enforcement from edge to API to service to AI runtime layers
• Support secure cloud-native, containerized, and sandboxed deployment patterns (Google, AWS, Azure)
• Define security telemetry and audit requirements for agentic systems
• Support detection and response for runaway agents or excessive autonomy
• Align implementations with enterprise security standards and governance expectations
• Documentation & knowledge transfer. Produce architecture, runbooks, and POC findings; upskill the internal IAM team for ongoing ownership

Required Skills & Experience

• 8+ years of experience in security engineering, application security, or platform security
• Proven experience delivering enterprise IAM / non-human identity solutions
• Strong foundation in web applications and API security
• Experience designing fine-grained least-privilege access models for distributed systems
• Experience working with AI-enabled or automation-heavy systems
• Familiarity with risks unique to agentic or autonomous systems
• Ability to reason about non-deterministic execution and enforce deterministic controls
• MCP Security Standards and agent runtime authorization
• Experience with WAFs, API gateways, and edge security controls
• Familiarity with cloud-native architectures and service-to-service security
• Non-Human Identity (NHI) lifecycle management in highly dynamic environments
• Deep working knowledge of OAuth 2.0/2.1, OIDC, token exchange (OBO), and modern token security (PKCE, audience binding, short-lived tokens)
• Experience with workload identity: SPIFFE/SPIRE, mTLS, and PKI/certificate-based authentication
• Experience with secrets management and eliminating static/long-lived credentials
• Solid grasp of Zero Trust, least privilege, and identity lifecycle/recertification
• Ability to work closely with product, platform, AI/ML, and identity teams
• Strong written and verbal communication skills
• Ability to translate complex security concepts into practical guidance

Preferred / Nice To Have

• Experience with agent frameworks or orchestration systems
• Familiarity with policy-as-code or runtime enforcement models
• Experience with AI/LLM security risks (e.g., OWASP Top 10 for LLM Applications, agentic threat models)
• Experience in regulated or high-availability environments