security engineer for A2A gateways

The platform is a production-grade agentic AI ecosystem with agent-to-agent (A2A) gateways and channels. It uses trust models and policy enforcement to maintain security and reliability across the platform.

• Design and validate A2A trust models, including OAuth 2.0 with signed Agent Cards, JWT validation, and token scope enforcement for agent channels
• Develop Python-based security test automation
• Create and execute functional and security test plans
• Conduct performance testing using k6 and Locust
• Test Cedar policy enforcement for permit/deny correctness, forbid-overrides-permit, and LOG_ONLY versus ENFORCE modes
• Perform threat modelling for agentic AI and LLM systems, including OWASP Top 10 for LLMs, excessive agency, and tool parameter exfiltration

• At least three years of experience in security engineering or quality assurance
• Expertise in API security testing
• Experience with performance benchmarking for cloud APIs
• Experience designing security tests for AI or agent systems beyond REST APIs
• Experience with enforcement mechanism design or implementation
• Будет плюсом: knowledge of multi-agent communication security patterns, experience with trust model gap analysis for non-AgentCore A2A agents

• Условий в вакансии нет