Senior Security & Test Engineer – A2A Gateway

About the role

We are seeking a Senior Security & Test Engineer to own the security, functional, and performance test suites for our A2A gateway within an enterprise‑grade Agent Development Platform. The role focuses on validating Cedar policy enforcement, performing trust‑model gap analysis, and ensuring consistent security and governance across AI‑agent services.

Key responsibilities

• Maintain and expand security, functional, and performance test suites for the A2A gateway.
• Validate Cedar policy enforcement in LOG_ONLY and ENFORCE modes.
• Conduct trust‑model gap analysis for non‑AgentCore A2A agents.
• Design and execute functional and security test strategies for agentic AI systems.
• Develop Python‑based security test automation frameworks.
• Perform API performance testing and benchmarking using k6 and Locust.
• Test permit/deny logic and forbid‑overrides‑permit behavior in Cedar policies.
• Apply AI/LLM threat‑modeling practices to identify risks such as excessive agency and tool parameter exfiltration.
• Evaluate trust‑model components including OAuth 2.0, signed Agent Cards, JWT validation, and token‑scope enforcement.

Required profile

• 3+ years of experience in security engineering or quality assurance.
• Strong background in API security testing and performance benchmarking for cloud services.
• Experience designing security tests for AI/agent systems beyond traditional REST APIs.
• Knowledge of enforcement mechanisms and Cedar policy testing.
• Excellent written and spoken English (B2+ level).

Required skills

• Python programming.
• API security testing.
• Performance testing tools: k6, Locust.
• Cedar policy testing (permit/deny, LOG_ONLY vs ENFORCE).
• OAuth 2.0, JWT validation, signed Agent Cards.
• Cloud platforms – AWS (AgentCore Runtime).
• AI/LLM threat‑modeling frameworks, OWASP Top 10 for LLMs.

What we offer

• Innovative projects with global impact.
• Flexible work environment – vibrant office or remote.
• Opportunity to work abroad up to two months per year.
• Relocation possibilities across 55+ countries.
• Corporate and social events.
• Leadership development, career advising, and well‑being programs.
• Certification support for GCP, Azure, and AWS.
• Unlimited access to EPAM’s internal learning platform.
• Free English classes with certified teachers.