ICAM Security Engineer (Hybrid/Remote) | OAuth, mTLS, RBAC

Leidos Inc

Gaithersburg (MD)

Hybrid

USD 90,000 - 157,000

Full time

3 days ago

Be an early applicant

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Job summary

Leidos is seeking an ICAM / Identity Engineer to join the Air Traffic Business Area, delivering the L-CAP platform with an AI-first engineering mindset in a hybrid cloud environment. You will implement ICAM layers, integrate with government ICAM services, and enforce per-session authorization across distributed services, including RBAC/ABAC and mTLS.

You will work within SAFe/Agile processes to deliver iterative value, supporting government programs and maintaining security logging, audit

Qualifications

Bachelor's degree in Cybersecurity, Computer Science, Information Technology or related field with 4+ years of experience.
Hands‑on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping.
Experience with enterprise identity providers and federation (Keycloak, Okta, Ping, Entra ID, or equivalent).
Experience implementing RBAC and/or ABAC within distributed applications.
Working knowledge of PKI, certificate lifecycle management, mutual TLS, and service mesh identity.
Understanding of Zero Trust principles with per-session authorization and default-deny principles.
Experience implementing audit logging for access and authorization events.
Proficiency in Java, Python, Go or similar language.
Working knowledge of NIST SP 800-53 AC and AU controls.
U.S. citizenship with ability to obtain Public Trust and complete government background investigations.

Responsibilities

Integrate L-CAP with government ICAM services using OAuth 2.0 / OpenID Connect, including token issuance and validation.
Implement identity federation and user stores (Keycloak or equivalent).
Enforce per-session authentication and authorization for user-to-service and service-to-service requests.
Manage mutual TLS, service mesh identity, and certificate lifecycle processes.
Design and implement RBAC and ABAC aligned to operations and support roles.
Handle sign-in, sign-out, and time-on-position logging for operational users.
Develop and maintain ICAM audit logging for access events.
Oversee API gateway authorization and protect external endpoints via API management.
Contribute to ICAM control evidence and AI-assisted development to improve quality and delivery.