Security engineer enterprise AI services

The project is building a centralized authorization layer for enterprise AI services and cloud applications. The platform enables secure, policy-based access decisions, integrates with enterprise identity providers, and supports governance, compliance, and audit requirements across distributed environments.

• Design and implement authorization frameworks using Cedar-based policies
• Develop and maintain policy-as-code solutions for enterprise platforms and AI services
• Define and enforce attribute-based access control models across applications and cloud environments
• Integrate authorization services with Microsoft Entra , OAuth 2.0, JWT, and OpenID Connect-based identity systems
• Design default-deny access models and secure authorization patterns
• Build and maintain audit logging mechanisms for authorization decisions and policy evaluations
• Collaborate with security architecture and governance teams on security reviews and compliance requirements
• Map identity claims and token attributes to authorization policies and access control models
• Review platform designs and recommend improvements to authorization, governance, and security controls
• Contribute to enterprise security standards, documentation, and best practices
• Support zero-trust initiatives and secure access programs across cloud environments

• At least 5 years of experience in cloud security engineering, identity engineering, or a related security field
• Hands-on experience designing and implementing attribute-based access control solutions
• Strong understanding of OAuth 2.0, JWT, OpenID Connect, and identity federation concepts
• Experience inspecting authentication tokens and mapping claims to authorization policies
• Experience designing, implementing, or governing policy-based access control systems
• Knowledge of Cedar policy language concepts, including principals, actions, resources, and conditions
• Experience with policy-as-code methodologies and authorization frameworks
• Experience participating in enterprise security reviews, architecture review boards, or information security governance processes
• Understanding of secure audit logging and authorization decision traceability
• Strong written and verbal communication skills
• Будет плюсом: experience with AWS Cedar or other Cedar-based authorization frameworks, AWS Verified Permissions or AWS Agent Core Policy services, zero-trust architecture principles and implementation patterns, enterprise AI platforms and authorization governance initiatives, cloud-native security services and modern identity architectures, scalable authorization platforms for distributed systems

Work location options include Armenia (Yerevan);
Bulgaria (remote, Sofia, Varna);
Cyprus (Larnaca);
Georgia (remote, Tbilisi);
Kazakhstan (Almaty, Astana, remote);
Latvia (Riga);
Poland (Krakow, Lodz, Lublin, remote, Warsaw, Wroclaw);
Romania (Cluj-Napoca);
Serbia (Belgrade); and Ukraine (Dnipro, Kharkiv, Kyiv, Lviv, Odesa)