ICAM Security Engineer - Zero Trust & IAM Expert

Via Logic LLC

Eagan (MN)

Hybrid

USD 87,000 - 157,000

Full time

3 days ago

Be an early applicant

Application generator

Don’t send a generic resume — generate a resume and cover letter tailored to this exact role.

Get past ATS filters

Job summary

Leidos is seeking an ICAM / Identity Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L-CAP). L-CAP is a mission-critical, future-ready automation platform built on a hybrid cloud data mesh architecture, enabling next-generation air traffic management capabilities.

You will implement the identity, credential, and access management layer, integrate with government ICAM services, enforce per-session

Qualifications

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology or related field.
Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping.
Experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent.
Experience implementing RBAC and/or ABAC within distributed applications.
Working knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS), and/or service mesh identity.
Understanding of Zero Trust principles, including per-session authorization and default-deny service communication.
Experience implementing audit logging for access and authorization events.
Proficiency in Java, Python, Go, or a comparable programming language.
Working knowledge of NIST SP 800-53 AC and AU controls.
Experience with Kubernetes and containerized service deployments.
U.S. citizenship required, with ability to obtain Public Trust and complete background investigations.
Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the previous 5 years.

Responsibilities

Integrate L-CAP services with government ICAM services using OAuth 2.0 and OpenID Connect, including token issuance, validation, and claims mapping.
Implement and maintain identity federation and user stores (Keycloak or equivalent), including role-based test account provisioning.
Implement per-session authentication and authorization for user-to-service and service-to-service requests, enforcing default-deny access.
Implement mutual TLS (mTLS), service mesh/workload identity, and certificate lifecycle management, including issuance, rotation, expiration monitoring and revocation.
Design and implement RBAC and ABAC aligned to operational and support roles.
Implement authentication and session management for operational users, including sign-in/sign-out and time-on-position logging.
Implement authentication and authorization audit logging, including event capture, storage and retrieval.
Implement API gateway authorization and ensure external-facing endpoints are registered and protected through API management layer.
Support security authorization and continuous monitoring by producing ICAM control evidence, resolving identity integration issues across distributed services, and leveraging AI-assisted development and automation to improve quality and delivery.