ICAM Security Engineer - Hybrid/Remote AI-Driven IAM

Leidos; Eagan (MN); Hybrid; USD 87,000 - 157,000; Full time

Benefits offered by this job

Hybrid work model

Job summary

Leidos is seeking an ICAM / Identity Engineer to help build the L-CAP platform with a strong focus on identity, credential, and access management. You will integrate with government ICAM services, enforce per-session authorization, and ensure secure access to distributed services across an Agile Release Train.

The role requires U.S. citizenship, Public Trust eligibility, FAA facility access requirements, and residency considerations (3 of the last 5 years).

Qualifications

• Bachelor's degree in cybersecurity, CS, IT, or related field with 4+ years of relevant experience.
• Hands-on with OAuth 2.0 / OIDC including token validation and claims mapping.
• Experience with identity providers and federation (Keycloak, Okta, Ping, Entra).
• Experience implementing RBAC and/or ABAC in distributed apps.

Responsibilities

• Integrate L-CAP with government ICAM services using OAuth 2.0 / OIDC.
• Implement identity federation and user stores (Keycloak or equivalent).
• Enforce per-session authentication and default-deny access policies.
• Implement mTLS, service mesh identity, and certificate lifecycle mgmt.
• Design RBAC/ABAC aligned to roles; manage sign-in/out and session logging.
• Provide ICAM control evidence and AI-assisted development improvements.

Skills

OAuth 2.0 / OIDC

Identity federation

RBAC / ABAC

mTLS / PKI

Kubernetes

Java / Python / Go

Zero Trust

Audit logging

API gateway auth

Public Trust eligibility

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology

Tools

Keycloak

Okta

Ping Identity

Microsoft Entra ID

Job description

Leidos is seeking an ICAM / Identity Engineer to help build the L-CAP platform with a strong focus on identity, credential, and access management. You will integrate with government ICAM services, enforce per-session authorization, and ensure secure access to distributed services across an Agile Release Train.

The role requires U.S. citizenship, Public Trust eligibility, FAA facility access requirements, and residency considerations (3 of the last 5 years).