Senior Security & Test Engineer, A2A

About the role

We are looking for a Senior Security & Test Engineer to own the security, functional, and performance test suites for our A2A gateway within an enterprise‑grade Agent Development Platform. The role ensures that policy enforcement, trust models, and overall governance meet the highest standards for AI‑driven agents deployed on a cloud‑native AWS runtime.

Key responsibilities

• Own and maintain security, functional, and performance test suites for the A2A gateway.
• Validate Cedar policy enforcement correctness in LOG_ONLY and ENFORCE modes.
• Conduct trust‑model gap analysis for non‑AgentCore A2A agents.
• Design and execute functional and security test strategies for agentic AI systems.
• Build Python‑based security test automation frameworks.
• Perform performance testing and benchmarking of cloud APIs using k6 and Locust.
• Test permit/deny correctness and forbid‑overrides‑permit logic within Cedar policies.
• Apply AI/LLM threat‑modeling practices to identify risks such as excessive agency and tool‑parameter exfiltration.
• Evaluate A2A trust‑model components, including OAuth 2.0, signed Agent Cards, JWT validation, and token‑scope enforcement.

Required profile

• 3+ years of experience in security engineering or quality assurance.
• Strong background in API security testing and performance benchmarking for cloud services.
• Experience designing security tests for AI/agent systems beyond traditional REST APIs.
• Knowledge of enforcement mechanisms and trust‑model concepts (OAuth 2.0, JWT, signed tokens).

Required skills

• Python programming for test automation.
• k6 and Locust performance‑testing tools.
• Cedar policy testing (permit/deny, LOG_ONLY vs ENFORCE).
• OAuth 2.0, JWT validation, token‑scope enforcement.
• API security testing and performance benchmarking.
• Agentic AI and LLM threat‑modeling frameworks (e.g., OWASP Top 10 for LLMs).
• Familiarity with AWS cloud‑native environments.