Senior Security Engineer with Cedar Policy

*This position is fully remote only for employment in Bulgaria. However, people can also work in one of our offices in Sofia or Varna if they prefer to.

About DataArt

DataArt is a global software engineering firm and a trusted technology partner for market leaders and visionaries. Our world-class team designs and engineers data-driven, cloud-native solutions to deliver immediate and enduring business value.

We promote a culture of radical respect, prioritizing your personal well-being as much as your expertise. We stand firmly against prejudice and inequality, valuing each of our employees equally.

We respect the autonomy of others before all else, offering remote, onsite, and hybrid work options. Our Learning and development centers, R&D labs, and mentorship programs encourage professional growth.

Our long-term approach to collaboration with clients and colleagues alike focuses on building partnerships that extend beyond one-off projects. We provide the ability to switch between projects and technology stacks, creating opportunities for exploration through our learning and networking systems to advance your career.

Position Overview

This project focuses on building a centralized authorization layer for enterprise AI services and cloud applications. The platform enables secure, policy based access decisions, integrates with enterprise identity providers, and supports governance, compliance, and audit requirements across distributed environments. You will work closely with security, platform, and architecture teams to establish scalable policy controls, auditability, and zero trust access models.

T****echnology stack

AWS AgentCore Policy, Cedar, OAuth 2.0, JWT, OpenID Connect, Microsoft Entra ID, Policy as Code Frameworks, Cloud Security Controls, Audit Logging Systems, Zero Trust Architecture, AWS Verified Permissions

Responsibilities

• Design and implement authorization frameworks using Cedar based policies
• Develop and maintain policy as code solutions for enterprise platforms and AI services
• Define and enforce attribute based access control models across applications and cloud environments
• Integrate authorization services with Microsoft Entra ID, OAuth 2.0, JWT, and OpenID Connect based identity systems
• Design default deny access models and secure authorization patterns
• Build and maintain audit logging mechanisms for authorization decisions and policy evaluations
• Collaborate with security architecture and governance teams to support security reviews and compliance requirements
• Map identity claims and token attributes to authorization policies and access control models
• Review platform designs and recommend improvements for authorization, governance, and security controls
• Contribute to enterprise security standards, documentation, and best practices
• Support zero trust initiatives and secure access programs across cloud environments

Requirements

• 5+ years of experience in cloud security engineering, identity engineering, or a related security field
• Hands on experience designing and implementing attribute based access control solutions
• Strong understanding of OAuth 2.0, JWT, OpenID Connect, and identity federation concepts
• Experience inspecting authentication tokens and mapping claims to authorization policies
• Experience designing, implementing, or governing policy based access control systems
• Knowledge of Cedar policy language concepts, including principals, actions, resources, and conditions
• Experience working with policy as code methodologies and authorization frameworks
• Experience participating in enterprise security reviews, architecture review boards, or information security governance processes
• Understanding of secure audit logging and authorization decision traceability
• Strong written and verbal communication skills

Nice To Have

• Experience working with AWS Cedar or other Cedar based authorization frameworks
• Experience with AWS Verified Permissions or AWS AgentCore Policy services
• Knowledge of zero trust architecture principles and implementation patterns
• Experience supporting enterprise AI platforms and authorization governance initiatives
• Exposure to cloud native security services and modern identity architectures
• Experience building scalable authorization platforms for distributed systems

What We Offer

• Unique corporate culture – no micromanagement, friendly atmosphere, freedom, and mutual respect
• Flexible schedule – ability to change projects, to work from home, and to try yourself in different roles
• Professional Development Map – a comprehensive map of your professional development within DataArt
• We hire people not for a project, but for the company. If the project (or your work in it) is over, you go to another project or to a paid “Idle”.
• Social benefits – additional health insurance, life insurance, sports card, etc.
• Opportunity to work from another DataArt office in a different city or country (temporarily or permanently)
• Free English courses
• Cozy office with a great atmosphere
• Snacks, drinks, and fruits are always available

reference number: SEE00040