Identity Management Engineer / Architect (R-00197)

Job Responsibilities

• Design, implement, and operate enterprise IAM / ICAM architectures supporting on-premises, cloud, SaaS, and hybrid environments.
• Engineer and maintain directory services, including Active Directory and Microsoft Entra ID where included in the approved architecture.
• Design and automate user provisioning, deprovisioning, role assignment, access changes, and identity lifecycle management processes.
• Integrate enterprise applications using modern identity and federation standards including SAML, OpenID Connect (OIDC), OAuth, and SCIM.
• Implement and maintain Privileged Access Management (PAM) controls for administrative, elevated, and high-risk accounts.
• Design and operate Identity Governance and Administration (IGA) capabilities using SailPoint or approved enterprise identity-governance platforms.
• Integrate and administer AWS IAM Identity Center and related AWS identity and access-management capabilities.
• Implement PIV/CAC smart-card authentication, certificate-based authentication, and other approved strong-authentication mechanisms.
• Enforce phishing-resistant multi-factor authentication for privileged and mission-critical access.
• Align identity architectures, authentication methods, credential lifecycle processes, and access controls with FICAMrequirements and applicable government identity standards.
• Develop and enforce least-privilege, role-based, and policy-based access controls across enterprise systems and applications.
• Automate identity-management processes using scripting, APIs, infrastructure-as-code, and workflow technologies.
• Integrate PAM, IGA, directory, cloud identity, and authentication platforms to provide consistent identity controls across environments.
• Implement monitoring, logging, auditing, and alerting for authentication events, privileged activity, identity lifecycle changes, and access-policy violations.
• Perform periodic access reviews, entitlement analysis, privileged-account reviews, and identity-governance activities.
• Partner with application, cloud, cybersecurity, platform, and DevSecOps teams to securely onboard applications and services into enterprise identity platforms.
• Troubleshoot complex authentication, federation, provisioning, directory synchronization, authorization, and access-management issues.
• Maintain identity architecture documentation, integration standards, operational procedures, access-control models, and governance processes.

Job Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related technical discipline.
• Demonstrated experience designing, engineering, or administering enterprise IAM / ICAM solutions.
• Strong experience with Active Directory and cloud-based directory services such as Microsoft Entra ID.
• Hands-on experience with identity federation and provisioning standards including SAML, OIDC, OAuth, and SCIM.
• Experience implementing or operating Privileged Access Management platforms and privileged identity workflows.
• Experience with Identity Governance and Administration, preferably using SailPoint IdentityIQ or SailPoint Identity Security Cloud.
• Experience with AWS IAM, AWS IAM Identity Center, and cloud identity integration.
• Strong understanding of authentication, authorization, RBAC, ABAC, least privilege, and identity lifecycle management.
• Experience implementing PIV/CAC, certificate-based authentication, and phishing-resistant MFA.
• Familiarity with FICAM, federal identity standards, and authentication requirements for government environments.
• Strong understanding of Zero Trust architecture, with particular emphasis on identity as a primary policy-enforcement and access-control pillar.
• Experience automating identity workflows using APIs, scripting languages, PowerShell, Python, Terraform, or comparable automation technologies.
• Experience integrating identity platforms with SaaS applications, cloud services, enterprise applications, and hybrid infrastructure.
• Experience with centralized logging, identity monitoring, audit reporting, access reviews, and compliance evidence collection.
• Experience supporting government, defense, GovCloud, or other regulated environments is preferred.
• Strong architecture, troubleshooting, documentation, governance, and cross-functional collaboration skills.
Preferred Certifications:
• AWS Certified Security – Specialty
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Cybersecurity Architect Expert (SC-100)
• Certified Information Systems Security Professional (CISSP)
• SailPoint IdentityIQ / Identity Security Cloud certification
• CyberArk Defender or CyberArk Sentry