Agentic AI Security SME

Job Title: Agentic AI Security SME

Location: Remote

Duration: / Term: Fulltime

Experience Desired: 12+ Years

Job Description:

• Concrete understanding of agentic architectures: sub-agent chains, tool/function calling, MCP and A2A, and where identity collapses to a single service principal (the core failure mode).
• Ability to threat-model confused-deputy, privilege inheritance, and data-aggregation scenarios and translate them into per-hop, audience-restricted, least-privilege authorization designs.
• Externalized authorization for agents: OPA/Rego and/or Cedar, PEP/PDP placement, and an AuthZEN-style contract to keep policy portable across environments.
• Familiarity with LLM-gateway enforcement (BofA''s version is called Orchestra.ai today) as a policy enforcement point, and Bedrock AgentCore Gateway / AgentCore Policy (Cedar) as the native-exploit option on Bedrock.
• Grounding in the frameworks they''ve reviewed (OWASP LLM/Agentic Top 10, MITRE ATLAS, NIST AI RMF) so the review traces to something defensible.

Nice to have

• Semantic-guardrail integration as pluggable signal providers (Bedrock Guardrails, Azure Content Safety) feeding deterministic authZ, not model evaluation, but knowing the boundary.

Key Skills:

AI Security, Agentic AI, MCP, A2A, Bedrock, AgentCore, OWASP LLM