ICAM Security Engineer | Identity & Access Specialist (Hybrid)

Leidos

Gaithersburg (MD)

Hybrid

USD 87,000 - 157,000

Full time

5 days ago

Be an early applicant

Application generator

An application made for this job — a tailored resume and cover letter that speak straight to the posting.

Get past ATS filters

Job summary

Leidos is seeking an ICAM / Identity Engineer to support the L-CAP platform within the Air Traffic Business Area. The role covers OAuth 2.0/OpenID Connect integration, identity federation with Keycloak, and per-session authorization across distributed services.

You will implement mTLS, RBAC/ABAC, and audit logging, while ensuring API gateway authorization and secure access for government environments. A U.S. citizen with Public Trust eligibility is required and residency rules apply.

Qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology or related field; 4+ years of relevant experience.
Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping.
Experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent.
Experience implementing RBAC and/or ABAC within distributed applications.
Working knowledge of PKI, certificate lifecycle management, mutual TLS, and service mesh identity.
Understanding of Zero Trust principles, including per-session authorization and default-deny.
Experience implementing audit logging for access and authorization events.
Proficiency in Java, Python, Go or similar languages.
Working knowledge of NIST SP 800-53 AC/AU controls.
Experience with Kubernetes and containerized service deployments.
U.S. citizenship required with ability to obtain Public Trust and complete investigations.
Must meet FAA facility and information system access requirements (3 of 5 years residency).

Responsibilities

Integrate L-CAP services with government ICAM services using OAuth 2.0 and OpenID Connect.
Implement and maintain identity federation and user stores (Keycloak or equivalent).
Implement per-session authentication and authorization with default-deny access.
Implement mutual TLS, service mesh identity, and certificate lifecycle management.
Design and implement RBAC and ABAC aligned to operational roles.
Manage authentication and session logging for operational users.
Implement ICAM audit logging and event capture.
Provide API gateway authorization and protect external endpoints.
Support continuous security monitoring and ICAM control evidence.