Hybrid Identity Security Engineer — Zero-Trust IAM

CoStar; Arlington (VA); Hybrid; USD 133,000 - 203,000; Full time

Benefits offered by this job

Healthcare benefits

401(k) matching

Employee stock purchase plan

Paid time off

Job summary

CoStar Group is seeking a Senior Identity Security Engineer in Arlington, VA or San Diego, CA, with hybrid schedule (in office Mon–Thu,; remote Fri). You will harden identity controls for 8000+ employees, lead conditional access designs, and partner across Security, DevOps, and IT to strengthen authentication across the enterprise.

The role requires hands-on IAM experience, familiarity with Okta/Entra AD, and a focus on zero-trust concepts. Location flexibility supports both coasts.

Qualifications

• Bachelor’s degree required from an accredited university.
• 4+ years of hands-on security engineering experience.
• Experience administering IDP tools (Okta, PingID, Entra, AD).
• Knowledge of authentication/authorization protocols (SAML, OAuth, OIDC, Kerberos).

Responsibilities

• Design and implement identity security controls across platforms.
• Develop conditional access policies enforcing authentication strength and device compliance.
• Analyze logs to guide rollout of security initiatives.
• Support enterprise phish-resistant authentication rollout.
• Engineer controls around AI and workload identities.
• Prototype and operationalize AI-assisted tooling to improve efficiency.
• Document projects, standards, and runbooks.
• Communicate with technical and non-technical stakeholders.

Skills

Identity security

Scripting (Python)

Policy development

SIEM analytics

OAuth/OIDC/SAML

Education

Bachelor's Degree

Tools

Okta

Microsoft Entra ID

Active Directory

AzureHound

Job description

CoStar Group is seeking a Senior Identity Security Engineer in Arlington, VA or San Diego, CA, with hybrid schedule (in office Mon–Thu,; remote Fri). You will harden identity controls for 8000+ employees, lead conditional access designs, and partner across Security, DevOps, and IT to strengthen authentication across the enterprise.

The role requires hands-on IAM experience, familiarity with Okta/Entra AD, and a focus on zero-trust concepts. Location flexibility supports both coasts.