Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 5 days ago

Hiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ Years

TMS LLC7 open roles

Where
Remote, OR, United States
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowHiring: Cloud Security / AI Security Engineer | AWS IAM & Cedar Policies | Remote | 15+ YearsTMS LLC · Remote, OR, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on TMS LLC's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.9% of postings close within 7 days. Measured by our own scanner across the market. TMS LLC postings stay open a median of 10 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 12.9%7 days
  4. 21.0%14 days
  5. 35.6%30 days
  6. 58.5%60 days
This job: posted 5 days ago

TMS LLC median: 10 days open

The posting

Job Description

Role: Cloud Security Engineer / AI Security Engineer

Location: Los Angeles, CA (Remote – 10% Travel; must be comfortable traveling to client sites for workshops and meetings)

Duration: 3+ Months (Extension Possible)

💼 Experience: 15+ Years

Primary Skills: IAM Policy Templates, Cedar Policies

Role Overview:

Seeking an experienced Security Engineer with 15+ years of experience in cloud security and identity management to secure enterprise AI applications on AWS. The role focuses on authentication, reusable IAM policy templates, Cedar-based authorization, and secure access to tools, APIs, and enterprise resources.

Key Responsibilities

1. IAM Policy Templates & Access Management

  • Design, develop, and maintain reusable AWS IAM policy templates for AI agents and AgentCore infrastructure.
  • Implement role-based access control (RBAC) and least-privilege security principles.
  • Define IAM roles, trust policies, permission boundaries, and resource-based policies.
  • Configure IAM execution roles for AgentCore Runtime and AgentCore Gateway.
  • Develop standardized IAM templates for accessing AWS services such as Lambda, S3, Bedrock, API Gateway, Secrets Manager, and CloudWatch.
  • Automate IAM policy deployment and configuration using Terraform, AWS CloudFormation, or AWS CDK.
  • Conduct IAM access reviews, permission audits, and policy validation.
  • Troubleshoot access-denied issues, role-assumption failures, and authorization misconfigurations.

2. Cedar Policies at AgentCore Gateway

  • Design, author, test, and deploy Cedar authorization policies using Amazon Bedrock AgentCore Policy.
  • Implement fine-grained authorization for AI agents accessing tools through AgentCore Gateway.
  • Define policies specifying which identities can invoke particular tools, APIs, and operations.
  • Configure policy engines and associate them with AgentCore Gateways.
  • Implement attribute-based access control (ABAC) using identity attributes, roles, scopes, and contextual conditions.
  • Develop policies that restrict sensitive tool operations based on business roles, permissions, and security requirements.
  • Validate Cedar policies against gateway schemas and test permitted and denied access scenarios.
  • Enforce default-deny authorization and prevent unauthorized tool execution.
  • Monitor and troubleshoot authorization decisions and policy evaluation failures.

3. Security Governance & Compliance

  • Implement security controls for enterprise AI agents and Generative AI applications.
  • Develop security standards for agent identities, API integrations, and access management.
  • Support audit logging, access traceability, and security monitoring using AWS CloudTrail and CloudWatch.
  • Identify and mitigate risks including excessive privileges, credential exposure, unauthorized tool access, and privilege escalation.
  • Conduct security reviews of agent architecture and integrations.
  • Collaborate with AI engineering and DevOps teams to ensure secure production deployments.

4. Security Automation & DevSecOps

  • Automate security policy deployment through GitHub Actions and infrastructure-as-code pipelines.
  • Integrate IAM and Cedar policy validation into CI/CD workflows.
  • Implement automated security checks and policy compliance testing.
  • Maintain version-controlled security configurations across development, testing, and production environments.
  • Support security incident investigation, access troubleshooting, and remediation.

Required Technical Skills

  • AWS Security: IAM, IAM roles, policies, STS, AWS Secrets Manager, CloudTrail, CloudWatch.
  • Authorization: Cedar policy language, RBAC, ABAC, fine-grained access control.
  • Authentication: OAuth 2.0, OIDC, JWT, AWS IAM authentication.
  • Infrastructure as Code: Terraform, AWS CDK, or CloudFormation.
  • Automation: Python, GitHub Actions, CI/CD security integration.
  • Cloud Security: Least-privilege access, identity federation, credential management, and secure API integrations.

Additional Information

All your information will be kept confidential according to EEO guidelines.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against TMS LLC's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on TMS LLC's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    TMS LLC's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.