ICAM Security Engineer

Via Logic LLC; Egg Harbor Township (NJ); Hybrid; USD 87,000 - 157,000; Full time

Job summary

Leidos is seeking an ICAM / Identity Engineer to advance the L-CAP platform within a SAFe/Agile environment for government programs. The role focuses on IAM, per-session authorization, and integration with government ICAM services using OAuth 2.0 and OpenID Connect. You will implement PKI, mTLS, and service mesh identity, enforce default-deny access, and contribute to audit logging and security automation.

A U.S. citizen with Public Trust eligibility is required.

Qualifications

• Bachelor's degree in cybersecurity, CS, IT or related field with 4+ years of relevant experience.
• Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation and claims mapping.
• Experience with enterprise identity providers and federation (Keycloak, Okta, Ping, Entra ID).
• Experience implementing RBAC and ABAC within distributed applications.
• Knowledge of PKI, certificate lifecycle management, and mTLS/service mesh identity.
• Understanding of Zero Trust principles and per-session authorization.
• Experience with audit logging for access and authorization events.
• Proficiency in Java, Python, Go or similar languages.
• U.S. citizenship with ability to obtain Public Trust; FAA facility access requirements.

Responsibilities

• Integrate L-CAP with government ICAM services using OAuth 2.0 and OpenID Connect.
• Implement per-session authentication/authorization for user-to-service and service-to-service calls.
• Enforce default-deny access across distributed services and networks.
• Manage mutual TLS, service mesh identity, and certificate lifecycle routines.
• Design RBAC and ABAC aligned to operational/support roles.
• Ensure sign-in/sign-out and time-on-position logging for operational users.
• Produce ICAM control evidence and audit trails for compliance.
• Protect external endpoints via API gateway authorization and integration.

Skills

OAuth 2.0 & OpenID Connect

Identity federation

RBAC & ABAC

Kubernetes & container deployments

Java, Python, Go

Zero Trust

Audit logging

mTLS & service mesh identity

Public Trust eligibility

SAFe / Agile

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Keycloak

Okta

Ping Identity

Microsoft Entra ID

Job description

Leidos is seeking an ICAM / Identity Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities. We are building with an AI-first engineering mindset, embracing emerging AI capabilities and modern development practices to accelerate delivery, improve software quality, and continuously evolve how we design and build mission-critical systems. This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program. This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation.

This is a hybrid position requiring 3 days onsite and 2 days working from home, if you are located within a commutable distance (Less than 1 hour's drive one-way during normal traffic) from Gaithersburg, MD; Eagan, MN; or Egg Harbor Township, NJ. However, if you do not reside within a commutable distance, you may be considered for a 100% remote role.

In this role, you will implement the identity, credential, and access management (ICAM) layer that governs every user and service interaction with L-CAP. You will integrate the platform with government-provided ICAM services, enforce per-session authorization across distributed mission services, and build the access control and audit foundations that operational and support users depend on.

What You’ll Do:

• Integrate L-CAP services with government-provided ICAM services using OAuth 2.0 and OpenID Connect, including token issuance, validation, and claims mapping.
• Implement and maintain identity federation and user stores (Keycloak or equivalent), including role-based test account provisioning.
• Implement per-session authentication and authorization for user-to-service and service-to-service requests, enforcing default-deny access regardless of network location.
• Implement mutual TLS (mTLS), service mesh/workload identity, and certificate lifecycle management, including issuance, rotation, expiration monitoring, and revocation.
• Design and implement role-based (RBAC) and attribute-based (ABAC) access controls aligned to operational and support roles.
• Implement authentication and session management for operational users, including sign-in/sign-out and time-on-position logging.
• Implement authentication and authorization audit logging, including event capture, storage, and retrieval.
• Implement API gateway authorization and ensure external-facing endpoints are registered and protected through the API management layer.
• Support security authorization and continuous monitoring by producing ICAM control evidence, resolving identity integration issues across distributed services, and leveraging AI-assisted development and automation to improve quality and delivery.

Core Technical Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field with 4+ years of relevant experience.(additional experience, education and training may be considered in lieu of degree)
• Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping.
• Experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent.
• Experience implementing RBAC and/or ABAC within distributed applications.
• Working knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS), and/or service mesh identity.
• Understanding of Zero Trust principles, including per-session authorization and default-deny service communication.
• Experience implementing audit logging for access and authorization events.
• Proficiency in Java, Python, Go, or a comparable programming/scripting language.
• Working knowledge of NIST SP 800-53 Access Control (AC) and Audit and Accountability (AU) controls.
• Experience with Kubernetes and containerized service deployments.
• U.S. citizenship required, with the ability to obtain and maintain a Public Trust and successfully complete required government background investigations.
• Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the previous 5 years.

Preferred / Desired Qualifications:

• Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II certification.
• Federal ICAM/FICAM experience, including PIV/CAC or agency ICAM integrations.
• Experience with SAML 2.0 and SCIM provisioning.
• Experience with Kubernetes RBAC and workload identity (SPIFFE/SPIRE).
• Experience with service mesh implementation (Istio, Linkerd).
• Experience with API gateway authorization policy (Kong, Apigee, or equivalent).
• Familiarity with FIPS 140-3 validated cryptographic modules, hardware security modules, or enterprise key management.
• Knowledge of privileged access management practices.
• Experience in aviation, FAA, or other safety-critical environments.
• Experience with SAFe or large-scale Agile delivery.

Why Leidos?

You’ll work on systems where performance, precision, and reliability matter - every second. This is not experimental AI for prototypes. This is disciplined, responsible AI applied to mission-critical software that supports national infrastructure.

If you’re excited by solving complex problems in regulated, real-world environments - and using AI as a force multiplier rather than a shortcut - we’d like to talk.

ATMC

If you're looking for comfort, keep scrolling. At Leidos, we outthink, outbuild, and outpace the status quo - because the mission demands it. We're not hiring followers. We're recruiting the ones who disrupt, provoke, and refuse to fail. Step 10 is ancient history. We're already at step 30 - and moving faster than anyone else dares.

Original Posting:

September 21, 2026

Pay Range:

Pay Range $87,100.00 - $157,450.00

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay and Benefits

Pay and benefits are fundamental to any career decision. That's why we craft compensation packages that reflect the importance of the work we do for our customers. Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement. More details are available at www.leidos.com/careers/pay-benefits.

Securing Your Data

Beware of fake employment opportunities using Leidos’ name. Leidos will never ask you to provide payment-related information during any part of the employment application process (i.e., ask you for money), nor will Leidos ever advance money as part of the hiring process (i.e., send you a check or money order before doing any work). Further, Leidos will only communicate with you through emails that are generated by the Leidos.com automated system - never from free commercial services (e.g., Gmail, Yahoo, Hotmail) or via WhatsApp, Telegram, etc. If you received an email purporting to be from Leidos that asks for payment-related information or any other personal information (e.g., about you or your previous employer), and you are concerned about its legitimacy, please make us aware immediately by emailing us at [e-mail].

If you believe you are the victim of a scam, contact your local law enforcement and report the incident to the U.S. Federal Trade Commission.

Commitment to Non-Discrimination

All qualified applicants will receive consideration for employment without regard to sex, race, ethnicity, age, national origin, citizenship, religion, physical or mental disability, medical condition, genetic information, pregnancy, family structure, marital status, ancestry, domestic partner status, sexual orientation, gender identity or expression, veteran or military status, or any other basis prohibited by law. Leidos will also consider for employment qualified applicants with criminal histories consistent with relevant laws.