{"id":2123601,"url":"https://alion.io/job/epam-systems-poland-lead-agent-identity-engineer","title":"Lead Agent Identity Engineer","company":{"id":2612641,"name":"EPAM Systems Poland","domain":"epam-poland.pl","url":"https://alion.io/company/epam-poland","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Poland"],"countries":["PL"],"hiring_countries":["PL"],"hiring_countries_total":1,"salary":null,"salary_estimate":{"min_usd":46000,"max_usd":93000,"period":"year","method":"role_seniority_country_cell","sample_n":12},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"AWS Bedrock","optional":false},{"name":"AWS Bedrock AgentCore","optional":false},{"name":"AWS Strands Agents","optional":false},{"name":"LangGraph","optional":false},{"name":"Okta","optional":false},{"name":"A2A","optional":true},{"name":"Anthropic","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"LangChain","optional":true},{"name":"Model Context Protocol","optional":true},{"name":"Platform Engineering","optional":true}],"status":"live","first_seen_at":"2026-10-08T12:16:17Z","employer_posted_date":null,"last_verified_at":"2026-10-08T12:16:17Z","board_verified":false,"closed_at":null,"days_open":20,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":20},"description":"We are looking for a Lead Agent Identity Engineer to own runtime identity and access control for an Enterprise Agent Development Platform — a production-grade, cloud-native ecosystem that enables engineering teams to define, orchestrate, deploy, and observe AI agents at scale. The role covers inbound and outbound auth, on-behalf-of token exchange, and enterprise identity federation across agent to tool to API chains, using LangGraph and Strands Agents on AWS AgentCore Runtime.\nResponsibilities\nOwn runtime identity and access control for the agent platform, including inbound and outbound auth\nDesign and implement On-Behalf-Of (OBO) token exchange and scoped identity propagation across agent → tool → API chains\nIntegrate identity into the agent invocation lifecycle within AgentCore Runtime\nManage Gateway outbound authorization and per-target credentials, ensuring secrets are never exposed to the calling agent\nBuild and maintain token vault and workload identity brokering capabilities\nCoordinate Cedar / MS Entra claims mapping for identity-aware authorization with Runtime Controls\nValidate claims, scopes, audience, and issuer for JWT / OAuth 2.0 / OIDC tokens, including short-lived scoped tokens\nPartner with platform and security teams to enforce consistent identity governance across the agent ecosystem\nRequirements\n5+ years of experience in cloud security or identity engineering\nHands-on experience with identity and access control specifically for AI agents in a production agentic AI project, such as On-Behalf-Of (OBO) token exchange across agent-to-tool-to-API chains, AgentCore Identity, or agent identity federation (Entra Agent ID)\nExpertise in AWS Bedrock AgentCore Identity or similar technology, including inbound auth, outbound auth, and token vault\nHands-on implementation experience with OAuth 2.0, OIDC, and JWT, including token issuance, validation, and exchange\nExperience with On-Behalf-Of / token-exchange flows in production (RFC 8693 or equivalent)\nBackground in enterprise identity federation with MS Entra, Okta, or Cognito\nSkills in secure credential / secret management and token lifecycle, including rotation and vaulting\nEnglish proficiency at B2 level or higher\nNice to have\nShowcase of AWS Bedrock AgentCore Identity early adoption or equivalent experience\nFamiliarity with AWS AgentCore Gateway outbound-auth integration\nKnowledge of MCP / A2A tool-invocation auth patterns\nExposure to AgentCore Policy (Cedar) or AWS Verified Permissions\nWe offer\nWe gather like-minded people:\nTop tech minds driving innovation in AI, cloud and digital platform modernization\nSupportive team and agile, startup-like culture\nHybrid by design mode and opportunity to work remotely within Poland\nChance to work abroad for up to 60 days annually\nBusiness-driven relocation opportunities\n\nWe provide growth opportunities:\nCareer development programs\nThought leadership, mentoring, soft skills and well-being programs\nCertification (Anthropic, Gemini, GCP, Azure, AWS)\nEnglish classes\n\nWe cover it all:\nStable pay\nParticipation in the Employee Stock Purchase Plan with a 15% discount\nBenefits package (health insurance, multisport, shopping vouchers)\nReferral bonuses up to $2,000\nOffices featuring entertainment and relaxation zones, table tennis and football, free snacks, coffee and more\nCorporate, social and well-being events\n\nPlease, note:\nBenefits listed above are available to employees only\nWe are open for working with Contractors. Terms of B2B cooperation agreements are agreed individually\nWe will reach out to selected candidates exclusively\n\nEPAM is global leader in AI transformation engineering and integrated consulting, serving Forbes Global 2000 companies and ambitious startups. With over thirty years of expertise in custom software, product and platform engineering, we empower our clients to become AI-Native enterprises, driving measurable value from innovation and digital investments.\nTech stack\nIdentity and Access Management\nOAuth 2.0\nOpenId Connect\nJWT\nOn-Behalf-Of (OBO)\nAWS Bedrock AgentCore\nsecrets management","description_format":"text","description_chars":4069,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Growth opportunities","Health insurance"],"hiring_locations":[{"name":"Poland","iso":"PL","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["IT Consulting & Digital Transformation","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-10-08T23:50:21Z"}],"visa":[],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":0.85,"p_active":0.79,"p_room":0.45,"age_days":19,"expected_fill_days":13,"reasons":["seen:19","velocity","win:tail","comp:brand"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/epam-systems-poland-lead-agent-identity-engineer","json_url":"https://alion.io/job/epam-systems-poland-lead-agent-identity-engineer.json","meta":{"generated_at":"2026-10-28T13:36:23Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18391,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2612641},"rest":"https://alion.io/mcp/rest/get_company?id=2612641"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fepam-systems-poland-lead-agent-identity-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fepam-systems-poland-lead-agent-identity-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fepam-systems-poland-lead-agent-identity-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/epam-systems-poland-lead-agent-identity-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fepam-systems-poland-lead-agent-identity-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2123601}},{"tool":"search_jobs","arguments":{"company":"epam-poland.pl","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2123601},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}