Identity Access Management (IAM) Engineer

RayTek Federal Corporation; United States; Remote; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health benefits

Remote flexibility for eligible roles

401(k) plan with company match

Job summary

RayTek Federal Corporation seeks an Identity Access Management Engineer to build and run the identity fabric for a DoD-focused modernization program. You will deploy Keycloak in AWS GovCloud on Kubernetes, federate with CAC/PIV providers, and design token-based access across applications.

You will implement silent sign-on, ABAC with Open Policy Agent, and lead onboarding of legacy apps to a shared broker. Experience with RMF evidence and government clouds is highly valued.

Qualifications

• Bachelor's degree in computer science or related field, or equivalent experience, and 5+ years focused on identity and access management.
• Deep hands-on Keycloak experience in production: realms, identity brokering, mappers, authentication flows, clustering, and upgrades.
• Strong working knowledge of OIDC, OAuth 2.0, SAML 2.0, and PKI / smart-card (CAC/PIV) authentication.
• Experience integrating single sign-on into legacy applications without rewriting them.
• Experience running identity services on Kubernetes in a regulated or Government cloud.

Responsibilities

• Design, deploy, and operate Keycloak as a credential-free federation broker in AWS GovCloud on Kubernetes, with high availability, backup, and upgrade paths.
• Federate to the customer's OIDC and SAML identity providers, including CAC/PIV (PKI) and non-PKI multi-factor paths.
• Build claim mappers and assurance levels that produce one normalized token: user type, roles, organization, and assurance.
• Register the platform as a relying party with the customer's identity providers and manage certificates, keys, and secrets rotation.
• Implement silent sign-on into existing applications without rewriting them.
• Work with the Platform Architect on attribute-based, least-privilege authorization with Open Policy Agent: claims, policy inputs, and decision logging.
• Write the identity integration guide and templates that application teams use to join the platform.
• Lead identity discovery with application owners: current login method, roles, and the path to the shared broker.
• Troubleshoot sign-on and access issues across onboarded applications.
• Write automated tests for role switching, revocation, prohibited actions, and token lifetime, run in the CI pipeline.
• Produce the identity portions of the security authorization (RMF) evidence with the security lead.
• Present identity design and status at sprint demonstrations and phase-exit reviews.

Skills

Keycloak

OIDC

SAML

CAC/PIV

Kubernetes

Open Policy Agent

Policy-as-code

Java

Go

AWS GovCloud

RMF

PKI

Education

Bachelor's degree in CS or related field

10+ years software/systems engineering experience

Tools

Helm

Terraform

OpenTofu

Job description

Identity Access Management (IAM) Engineer

RayTek is seeking an Identity Access Management Engineerto build and run the identity fabric at the center of a mission-application modernization program for a Department of War customer: one sign-on, one work surface, and a repeatable pattern for onboarding legacy applications to a shared platform. Every user and every application passes through this layer, so it gates the rest of the platform.

The fabric is a Keycloak broker that holds no local credentials. It federates to the customer's existing identity providers for CAC/PIV and identity-proofed MFA, issues one normalized token, and hands users into each application with short-lived, single-audience tokens. Success means users sign on once and reach every onboarded application with the right access, and the identity controls pass security review on the first submission.

Key responsibilities

Identity broker build and operations

• Design, deploy, and operate Keycloak as a credential-free federation broker in AWS GovCloud on Kubernetes, with high availability, backup, and upgrade paths.
  
• Federate to the customer's OIDC and SAML identity providers, including CAC/PIV (PKI) and non-PKI multi-factor paths.
  
• Build claim mappers and assurance levels that produce one normalized token: user type, roles, organization, and assurance.
  
• Register the platform as a relying party with the customer's identity providers and manage certificates, keys, and secrets rotation.
  

Token exchange and authorization

• Implement silent sign-on into existing applications without rewriting them.
  
• Work with the Platform Architect on attribute-based, least-privilege authorization with Open Policy Agent: claims, policy inputs, and decision logging.
  

Application onboarding

• Write the identity integration guide and templates that application teams use to join the platform.
  
• Lead identity discovery with application owners: current login method, roles, and the path to the shared broker.
  
• Troubleshoot sign-on and access issues across onboarded applications.
  

Security and evidence

• Write automated tests for role switching, revocation, prohibited actions, and token lifetime, run in the CI pipeline.
  
• Produce the identity portions of the security authorization (RMF) evidence with the security lead.
  
• Present identity design and status at sprint demonstrations and phase-exit reviews.
  

Requirements

Required qualifications

• Bachelor's degree in computer science or a related field, or equivalent experience, and 10+ years in software or systems engineering, with 5+ years focused on identity and access management.
  
• Deep hands-on Keycloak experience in production: realms, identity brokering, mappers, authentication flows, clustering, and upgrades.
  
• Strong working knowledge of OIDC, OAuth 2.0, SAML 2.0, and PKI / smart-card (CAC/PIV) authentication.
  
• Experience integrating single sign-on into legacy applications without rewriting them.
  
• Experience running identity services on Kubernetes in a regulated or Government cloud.
  

Desired qualifications

• Experience with DoD identity services (DISA E-ICAM, D-ICAM) or other Federal ICAM programs.
  
• Policy-as-code with Open Policy Agent / Rego.
  
• Zero-trust architecture experience; familiarity with NIST SP 800-63 assurance levels.
  
• Java (Keycloak SPI development) or Go; AWS GovCloud; Helm; OpenTofu or Terraform.
  
• Experience producing RMF authorization evidence for identity controls.
  
• Security+ or CISSP (DoD 8140 baseline).
  

RayTek Employee Benefits Highlights

Health and Wellness

• UnitedHealthcare Choice Plus HSA plan with 100% in-network preventive care and nationwide network and out-of-network coverage
  
• 24/7 virtual visits and behavioral health support, including the Sanvello app and in-person or virtual therapy
  
• Dental PPO with a $1,500 annual max and 100% preventive coverage
  
• Vision plan with $10 exams, a $150 frame allowance, and a $150 contact lens allowance
  
• Exercise reimbursement up to $360 per year
  
• Employer HSA match up to $1,200 (individual) or $2,400 (family) annually
  
• 401(k) plan with immediate eligibility and 100% vesting
  
• Employer 401(k) match up to 4% after 1 year
  
• Company-paid Life & AD&D at 1x annual salary, up to $100,000
  
• Company-paid Short-Term Disability: 60% of pay, up to $1,000 weekly, for up to 13 weeks
  
• Company-paid Long-Term Disability: 50% of pay, up to $8,000 monthly
  

Work-Life Balance

• 11 paid federal holidays (may vary by program)
  
• PTO accrual from day one
  
• Remote flexibility for eligible positions
  

Employee & Family Support

• Day-one eligibility for all benefits for full-time employees (30+ hours/week)
  
• Dependent coverage up to age 26
  
• Employee Assistance Program (EAP), available 24/7, with confidential counseling, legal, and financial support
  
• Travel Assistance Program for emergency medical care, evacuation, and global support
  
• Referral, commendation, and milestone service bonuses