IAM Architect (Remote)

Govcio LLC; United States; Remote; USD 155,000 - 175,000; Full time

Job summary

GovCIO is seeking an IAM Architect specializing in identity resolution and person matching to design enterprise capabilities establishing a single authoritative identity across VA systems. This role leads architecture for matching, deduplication, and linking records, combining ICAM with deterministic and probabilistic matching to improve data quality enterprise-wide.

The position is fully remote within the United States and contingent upon contract award.

Qualifications

• Bachelor's degree and 15 years engineering/architecture experience or equivalent.
• 12+ years in identity and access management engineering/architecture.
• 8+ years in cybersecurity with at least 5 years IAM architecture in large-scale environments.
• Hands-on identity matching/resolution at enterprise scale; deterministic and probabilistic linking.
• Deep understanding of federated identity protocols like SAML, OAuth 2.0, OIDC, SCIM, and LDAP.

Responsibilities

• Architect and lead enterprise identity resolution and person-matching capabilities across systems.
• Design deterministic and probabilistic record-linkage strategies for accurate identity resolution.
• Own MPI/Enterprise Identity Index architecture, match/merge rules and survivorship logic.
• Architect identity lifecycle management, provisioning/de-provisioning workflows, and privileged access controls.
• Implement Zero Trust identity principles across network and application boundaries.
• Lead federated identity, directory services, authentication, and SSO architecture.
• Define data-quality standards, matching thresholds, and audit/traceability requirements.
• Develop architecture diagrams, data flows, and compliance artifacts; brief stakeholders.
• Mentor IAM Engineers and review automation scripts; collaborate to deliver solutions.
• Perform root-cause analysis of identity-matching errors and drive continuous improvement.

Skills

IAM architecture

Federated identity

Zero Trust

SAML

OAuth 2.0

OIDC

SCIM

Active Directory/LDAP

Education

Bachelor's in CS/IS/related

Master's in related field

Tools

SailPoint

Okta

Microsoft Entra ID

Ping Identity

DigiCert

Job description

GovCIO is currently hiring an IAM Architect specializing in Identity Resolution and Person Matching to design and lead enterprise capabilities that establish a single, trusted, authoritative identity for every individual across mission and business systems at the Department of Veterans Affairs. This role owns the architecture for matching, deduplicating, and linking person records - combining traditional Identity, Credential, and Access Management (ICAM) engineering with deterministic and probabilistic identity-matching disciplines to reduce duplicate identities, prevent identity fraud, and improve data quality across the enterprise. This is a fully remote position located within the United States.

Please note: the contract has not been awarded; this position remains unfunded and is contingent upon the award of the contract.

Responsibilities

• Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a "golden record") across mission, HR, credentialing, and mission-partner data stores.
• Design deterministic and probabilistic record-linkage strategies - including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching - to accurately resolve person identities across disparate and inconsistently formatted data sources.
• Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.
• Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.
• Design and implement Zero Trust identity principles across enterprise network and application boundaries.
• Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).
• Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.
• Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.
• Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.
• Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.
• Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines.

Qualifications

Required Skills & Experience

• Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience).
  • 12+ years of experience in identity and access management engineering/architecture.
  • 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.
  • Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.
  • Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.
  • Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).
  • One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications.

Preferred Skills & Experience

• Experience with entity-resolution or Master Person Index (MPI).
• Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.
• Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).
• Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.
• Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.
• Master's degree in a related technical field.

Clearance Required: Must be able to obtain and maintain a suitability/public trust clearance.

Posted Salary Range

USD $155,000.00 - USD $175,000.00 /Yr.