ICAM Security Engineer

Leidos; United States; Hybrid; USD 140,000 - 170,000; Full time

Job summary

Leidos is seeking an ICAM / Identity Engineer to support the L-CAP platform within the Air Traffic Business Area. The role combines identity, access management, and security controls across a hybrid cloud environment for government programs.

You will implement and operate ICAM services, federation, RBAC/ABAC, and audit logging while coordinating with government ICAM services and enterprise identity providers. A Public Trust is required.

Qualifications

• Bachelor's degree or equivalent with 4+ years of relevant experience.
• Hands-on experience with OAuth 2.0 and OpenID Connect including token validation and claims mapping.
• Experience with enterprise identity providers and federation (Keycloak, Okta, Ping, Entra ID).
• Experience implementing RBAC and/or ABAC in distributed apps.
• Knowledge of PKI, certificate lifecycle, mTLS and service mesh identity.
• Understanding of Zero Trust, per-session authorization, and default-deny principles.
• Experience with audit logging for access and authorization events.
• Proficiency in Java, Python, Go, or similar languages.
• Kubernetes and containerized deployments experience.
• U.S. citizenship and ability to obtain Public Trust and satisfy FAA residency requirements.

Responsibilities

• Integrate L-CAP services with government ICAM services using OAuth 2.0 and OpenID Connect.
• Implement identity federation and user stores (Keycloak or equivalent).
• Enforce per-session authentication and authorization for user-to-service and service-to-service requests.
• Implement mTLS, service mesh identity, and certificate lifecycle management.
• Design and implement role-based and attribute-based access controls.
• Implement authentication and session management for operational users and event logging.
• Provide ICAM control evidence and collaborate on AI-assisted development to improve delivery.
• Ensure API gateway authorization and protection of external endpoints.

Skills

OAuth 2.0

OpenID Connect

RBAC/ABAC

mTLS

PKI

Zero Trust

Audit logging

Java

Python

Go

Kubernetes

Service mesh

APIs & Gateway security

Cloud architecture

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field

Tools

Keycloak

Okta

Ping

Microsoft Entra ID

Istio / Linkerd

Job description

Leidos is seeking an ICAM / Identity Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities. We are building with an AI-first engineering mindset, embracing emerging AI capabilities and modern development practices to accelerate delivery, improve software quality, and continuously evolve how we design and build mission-critical systems. This role operates within a SAFe/Agile framework as part of an Agile Release Train (ART) delivering iterative value across the program. This position supports government programs and requires the ability to obtain and maintain a favorable Public Trust investigation.

This is a hybrid position requiring 3 days onsite and 2 days working from home, i f you are located within a commutable distance (Less than 1 hour's drive one-way during normal traffic) from Gaithersburg, MD; Eagan, MN; or Egg Harbor Township, NJ. However, if you do not reside within a commutable distance, you may be considered for a 100% remote role.

In this role, you will implement the identity, credential, and access management (ICAM) layer that governs every user and service interaction with L-CAP. You will integrate the platform with government-provided ICAM services, enforce per-session authorization across distributed mission services, and build the access control and audit foundations that operational and support users depend on.

What You'll Do:

• Integrate L-CAP services with government-provided ICAM services using OAuth 2.0 and OpenID Connect , including token issuance, validation, and claims mapping.
• Implement and maintain identity federation and user stores (Keycloak or equivalent), including role-based test account provisioning.
• Implement per-session authentication and authorization for user-to-service and service-to-service requests, enforcing default-deny access regardless of network location.
• Implement mutual TLS (mTLS), service mesh/workload identity, and certificate lifecycle management , including issuance, rotation, expiration monitoring, and revocation.
• Design and implement role-based (RBAC) and attribute-based (ABAC) access controls aligned to operational and support roles.
• Implement authentication and session management for operational users, including sign-in/sign-out and time-on-position logging.
• Implement authentication and authorization audit logging , including event capture, storage, and retrieval.
• Implement API gateway authorization and ensure external-facing endpoints are registered and protected through the API management layer.
• Support security authorization and continuous monitoring by producing ICAM control evidence , resolving identity integration issues across distributed services, and leveraging AI-assisted development and automation to improve quality and delivery.

Core Technical Qualifications:

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology , or related field with 4+ years of relevant experience . (additional experience, education and training may be considered in lieu of degree)
• Hands-on experience with OAuth 2.0 and OpenID Connect , including token validation, introspection, and claims mapping.
• Experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent.
• Experience implementing RBAC and/or ABAC within distributed applications.
• Working knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS), and/or service mesh identity .
• Understanding of Zero Trust principles , including per-session authorization and default-deny service communication.
• Experience implementing audit logging for access and authorization events.
• Proficiency in Java, Python, Go , or a comparable programming/scripting language.
• Working knowledge of NIST SP 800-53 Access Control (AC) and Audit and Accountability (AU) controls.
• Experience with Kubernetes and containerized service deployments .
• U.S. citizenship required , with the ability to obtain and maintain a Public Trust and successfully complete required government background investigations.
• Must meet FAA facility and information system access requirements , including continuous U.S. residency for at least 3 of the previous 5 years .

Preferred / Desired Qualifications:

• Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II certification.
• Federal ICAM/FICAM experience, including PIV/CAC or agency ICAM integrations.
• Experience with SAML 2.0 and SCIM provisioning.
• Experience with Kubernetes RBAC and workload identity (SPIFFE/SPIRE).
• Experience with service mesh implementation (Istio, Linkerd).
• Experience with API gateway authorization policy (Kong, Apigee, or equivalent).
• Familiarity with FIPS 140-3 validated cryptographic modules, hardware security modules, or enterprise key managemen