Security & Test Engineer (A2A)

Sobre a vaga

We are looking for a Security & Test Engineer to validate the security, reliability, and trustworthiness of agent-to-agent communication platforms. The role combines security testing, performance validation, policy verification, and AI threat modeling for multi-agent systems. You will become a part of Core Architecture Team and be responsible for the architecture and implementation.

O que vais fazer

• Design and execute security and functional test strategies for A2A communication platforms
• Validate A2A trust models including OAuth 2.0 authentication, JWT validation, signed Agent Cards, and token scope enforcement
• Develop automated security test suites using Python
• Design and execute API security testing scenarios against agent communication channels and platform services
• Implement performance and load testing using tools such as k6 and Locust
• Design and maintain Cedar policy validation suites covering permit/deny behavior, policy precedence, forbid-overrides-permit logic, and policy mode transitions
• Validate LOG_ONLY versus ENFORCE behavior across authorization workflows
• Perform security reviews and threat modeling for agent ecosystems and AI-driven workflows
• Develop test scenarios covering prompt injection, excessive agency, tool misuse, parameter exfiltration, and other AI-specific attack vectors
• Verify authorization, policy enforcement, auditability, and trust boundaries between communicating agents
• Collaborate with platform, backend, and security teams to identify vulnerabilities and improve platform resilience
• Produce security reports, test documentation, risk assessments, and mitigation recommendations

O que é pedido

• A2A trust model (OAuth 2.0 + signed Agent Cards, JWT validation, token scope enforcement for agent channels)
• Python security test automation
• Functional and security test design
• Performance testing (k6, Locust)
• Cedar policy testing (permit/deny correctness, forbid-overrides-permit, LOG_ONLY vs ENFORCE mode)
• Agentic AI / LLM threat modelling (OWASP Top 10 for LLMs, excessive agency, tool parameter exfiltration)
• 4+ years security engineering or QA
• API security testing
• Performance benchmarking for cloud APIs
• Security test design for AI/agent systems (not just REST APIs)
• Enforcement mechanism design or implementation

Valorizado

• Multi-agent communication security patterns
• Trust model gap analysis for non-AgentCore A2A agents

Resumo organizado por IA a partir do anúncio original. Confirma os detalhes no site da empresa.