ICAM Architect – Zero Trust & PKI Expert (TS/SCI)

SAIC; Springfield (VA); On-site; USD 120,001 - 160,000; Full time

Job summary

SAIC seeks a skilled ICAM Architect to design, implement, and optimize identity, credential, and access management solutions for a mission-critical enterprise IT environment in Springfield, VA. You will lead ICAM efforts across on-premises, hybrid, and cloud environments, enforcing Zero Trust and FICAM standards while aligning with MAJESTIC JPO priorities.

The role requires 10–15 years of enterprise IT experience, deep expertise in SAML, OAuth, OpenID Connect, LDAP, PKI, SSO/MFA, and scripting.

Qualifications

• 10–15 years of enterprise IT experience.
• ICAM architecture experience with Zero Trust and FICAM.
• Experience integrating on-premises, hybrid, and cloud identity solutions.

Responsibilities

• Design ICAM architectures aligned with mission needs and Zero Trust.
• Develop identity lifecycle workflows (provisioning/deprovisioning/credentialing).
• Integrate on-premises, hybrid and cloud identity solutions (SAML/OAuth/OpenID).
• Deploy and manage SSO, MFA, PAM.
• Design RBAC/ABAC models and automate workflows (Ansible/Terraform/PowerShell).
• Monitor identity systems using SIEM tools (Splunk).
• Provide technical briefings and maintain documentation.

Skills

SAML/OAuth/OIDC

RBAC/ABAC

PKI/Credentialing

SSO/MFA

PowerShell-Bash-Terraform

Identity analytics/SIEM

Education

High School Diploma/GED

Bachelor's Degree in Cybersecurity/CS

Tools

Active Directory/Azure AD

LDAP

Okta/DIDO/Ping Identity

Job description

SAIC seeks a skilled ICAM Architect to design, implement, and optimize identity, credential, and access management solutions for a mission-critical enterprise IT environment in Springfield, VA. You will lead ICAM efforts across on-premises, hybrid, and cloud environments, enforcing Zero Trust and FICAM standards while aligning with MAJESTIC JPO priorities.

The role requires 10–15 years of enterprise IT experience, deep expertise in SAML, OAuth, OpenID Connect, LDAP, PKI, SSO/MFA, and scripting.