Security & Test Engineer (A2A)

A single weak link in an agent-to-agent (A2A) gateway can compromise the integrity of an entire agentic AI platform. The Security & Test Engineer (A2A) role in Portugal is fully remote and sits at the intersection of security, functional validation and performance assurance for a production-grade ecosystem. The platform's scale and complexity demand rigorous trust models and policy enforcement that keep pace with evolving threats. In this role, you decide how security and correctness are proven for every agent channel and policy mode. The person in this position shapes the standards that define trust and reliability across the platform.

Responsibilities

• Design and validate A2A trust models, including OAuth 2.0 with signed Agent Cards, JWT validation and token scope enforcement for agent channels
• Develop Python-based security test automation
• Create and execute functional and security test plans
• Conduct performance testing using k6 and Locust
• Test Cedar policy enforcement for permit/deny correctness, forbid-overrides-permit and LOG_ONLY versus ENFORCE modes
• Perform threat modelling for agentic AI and large language model (LLM) systems, including OWASP Top 10 for LLMs, excessive agency and tool parameter exfiltration

Requirements

• Three-plus years of experience in security engineering or quality assurance
• API security testing expertise
• Performance benchmarking for cloud APIs
• Security test design for AI or agent systems (beyond REST APIs)
• Experience with enforcement mechanism design or implementation

Nice to have

• Knowledge of multi-agent communication security patterns
• Experience with trust model gap analysis for non-AgentCore A2A agents