Identity & Access Management Engineer (PAM / Active Directory)

Signal Hill Technologies; Washington, Baltimore (District of Columbia, MD); Hybrid; USD 150,000 - 185,000; Full time

Benefits offered by this job

Company health plan

401(k) plan with employer match

Paid holidays and paid time off

Job summary

Signal Hill Technologies is seeking a Senior IAM Engineer to design and deploy privileged access for a large federal OT environment. You will own the PAM capability from design through production rollout, integrating with AD and Okta, ensuring least-privilege and just-in-time access, and implementing robust auditing and recovery plans.

The ideal candidate has extensive on-prem AD experience, understands certificate services and security tooling, and can navigate complex, isolated networks with

Qualifications

• Public Trust eligible; U.S. citizenship or green card and able to pass a background check.
• Strong written and verbal communication; explain identity and access decisions to technical and non-technical audiences.
• 5+ years in IT/cybersecurity engineering; 2+ years on-premises Active Directory engineering.
• Hands-on deployment of BeyondTrust in a large environment with password vaulting.
• Hands-on on-premises Active Directory engineering in a large enterprise (forest and domain design, GPO, tiering).
• Experience integrating Active Directory with Okta for SSO and MFA (SAML, OIDC, Kerberos, LDAP).
• Compensation: $150k-$185k annually; Company health plan, 401(k) with employer match, paid holidays and PTO.

Responsibilities

• Design and deploy BeyondTrust Privileged Remote Access across a large, multi-site OT environment.
• Integrate privileged access with Active Directory and Okta for secure authentication.
• Build least-privilege and just-in-time access workflows with password vaulting.
• Configure session recording and audit logging feeding the central SIEM.
• Engineer resilient access that remains functional when connectivity is lost.
• Harden and maintain the PAM platform for performance and availability across sites.
• Produce designs, runbooks, and security documentation for approval (ATO).

Skills

Active Directory

BeyondTrust

Okta

Password vaulting

SSO

MFA

SAML

Kerberos

LDAP

Session monitoring

Tools

BeyondTrust PAM

Password Safe

Okta

Job description

Job Title: Identity & Access Management Engineer (PAM / Active Directory)

Location: Hybrid - local to Fairfax, VA and able to go on site occasionally

Employment Type: Full-time, W-2

Eligibility: Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation) - no active clearance required.

About the Role

Critical infrastructure runs on operational technology that was never designed with today’s threats in mind. Those systems sit on isolated networks at hundreds of facilities, and administrators still need secure ways to reach them. Someone has to build that access so it is controlled, audited, and resilient without slowing down operations. That’s where you come in.

Signal Hill Technologies is seeking a Senior IAM Engineer to design and deploy privileged remote access for a large federal critical-infrastructure client. As one of the first engineers on the program, you will own the privileged access capability from design through production rollout. You will build audited administrative access to OT assets at distributed sites, tied into enterprise Active Directory and Okta, that keeps working locally when a site loses its connection to central services.

Also known as a Privileged Access Management (PAM) Engineer, IAM Engineer, Identity Architect, Active Directory Engineer, or Cybersecurity Engineer, you’ll bring the identity focus to a hands‑on cyber engineering role, working alongside our SIEM, PKI, and systems engineers.

You’ll also be a trusted technical voice with the client’s IT, CISO, networking, and system-owner teams. Getting a new capability through formal approval and into daily use is its own kind of engineering challenge, and doing it well is a real part of the job.

The ideal candidate is a Microsoft infrastructure engineer at heart, with years of on-premises Active Directory work behind them and hands‑on time deploying privileged access tools. Previous experience with BeyondTrust Privileged Remote Access or Password Safe, Active Directory migrations or consolidations in environments with tens of thousands of users, ADFS or Microsoft certificate services, Microsoft certifications such as MCSE, and work in OT, industrial control system, or isolated network environments.

Position Responsibilities

• Design and deploy BeyondTrust Privileged Remote Access across a large, multi-site operational technology environment.
• Integrate privileged access with Active Directory and Okta for secure, seamless authentication.
• Build least-privilege and just-in-time access workflows, with password vaulting for privileged accounts.
• Configure session recording and audit logging that feed the central SIEM.
• Engineer resilient access that keeps working when sites lose connectivity, backed by tested recovery plans.
• Harden and maintain the PAM platform for performance and availability across every site.
• Produce the designs, runbooks, and security documentation that carry the system through approval (ATO).

Minimum Qualifications

• Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation; no active clearance required).
• Strong technical writing and communication skills, with the ability to explain identity and access decisions to both technical and non-technical audiences.
• 5+ years of IT or cybersecurity engineering experience, including 2+ years of hands‑on on-premises Active Directory engineering.
• Hands‑on deployment of BeyondTrust in a large environment, including password vaulting.
• Hands‑on on-premises Active Directory engineering in a large enterprise (e.g., forest and domain design, group policy, privileged account tiering).
• Experience integrating Active Directory with Okta for SSO and MFA, using protocols such as SAML, OIDC, Kerberos, and LDAP.
• Experience with credential rotation and session monitoring.
• Compensation: $150k-$185k annually (depending on experience)
• Company health plan
• 401(k) plan with employer match
• Paid holidays and paid time off

About Signal Hill Technologies

Founded and led by veteran cyber operators, Signal Hill Technologies delivers advanced cybersecurity solutions to DoD, Intelligence Community, financial services, and critical infrastructure clients, with many years of experience defending both US Government and commercial clients against sophisticated, well‑funded, motivated adversaries. We are relentless about real results and operationally proven expertise. Our mission is to provide the best technical solutions and hands‑on support to address each customer's unique cyber risks.

Signal Hill Technologies is an equal opportunity employer. We do not discriminate based on race, color, religion, sex, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable law.