Identity and Access Management (IAM) Engineer (Microsoft Stack)

Rubicon Grp, LLC; Washington (District of Columbia); On-site; USD 185,000 - 225,000; Full time

Job summary

Rubicon Grp, LLC is seeking an Identity and Access Management (IAM) Engineer focused on the Microsoft ecosystem to design, secure, and maintain our enterprise identity infrastructure within classified environments.

The role requires 100% on-site work across DC, MD, and VA facilities, leveraging Microsoft Entra ID and Azure to enforce least privilege and advance a Zero Trust architecture. Strong PKI and RBAC experience preferred.

Qualifications

• Active TS/SCI clearance required at time of application.
• 100% on-site work required at multiple DMV locations.
• 8+ years of engineering experience focused on the Microsoft IAM platform.
• Deep knowledge of AD DS, GPOs, and Microsoft Entra ID.
• Strong understanding of Kerberos, NTLM, LDAP, SAML and OIDC.
• Proficiency with PowerShell and Graph API for identity management.
• Experience implementing Entra ID PIM, CA, and RBAC.

Responsibilities

• Provide on-site engineering support across secure facilities in DC, MD, and VA.
• Configure and maintain Microsoft Entra ID, Entra ID Governance, App Registrations, and Enterprise Applications.
• Manage hybrid identity with Entra Connect / Cloud Sync to synchronize on-prem AD with cloud.
• Design and deploy Conditional Access policies and MFA configurations.
• Automate user onboarding, transfers, and offboarding using Entra ID Lifecycle Workflows.
• Secure privileged access with Microsoft Entra PIM and Just-In-Time access.
• Configure federation, SSO, and token claims using SAML 2.0, OAuth 2.0, and OIDC.
• Develop automation scripts using Microsoft Graph PowerShell and Graph API.

Skills

Security clearance

On-site work

Microsoft IAM

Active Directory

PowerShell

Tools

Microsoft Entra ID

Azure

Graph API

Entra ID Governance

Entra Connect / Cloud Sync

PIM

SAML/OIDC

OAuth 2.0

Job description

Job Title:Identity and Access Management (IAM) Engineer (Microsoft Stack)
Location:On-site (Multiple locations across Washington D.C., Maryland, and Northern Virginia)
Employment Type:Full-time
Security Clearance:Active TS/SCI Required (CI Polygraph Eligible)
Salary Range:$185,000 – $225,000 / year(Dependent on experience, certifications, and polygraph status)

Job Summary

We are seeking anIdentity and Access Management (IAM) Engineer specializing in the Microsoft ecosystem to design, secure, and maintain our enterprise identity infrastructure within classified environments. In this role, you will lead the implementation and support of identity services across secure networks. You will leverageMicrosoft Entra ID and Azure services to enforce Least Privilege principles, optimize user lifecycles, and drive our transition toward a Zero Trust architecture.

This position requires 100% on-site work due to the secure nature of the environments. Candidates must be flexible to support multiple facility locations across the DC, MD, and VA (DMV) area.

Key Responsibilities

• On-Site & Facility Operations:Provide dedicated on-site engineering support across designated secure facilities in Washington D.C., Maryland, and Virginia.
• Entra ID Administration:Configure and maintain Microsoft Entra ID, including Entra ID Governance, App Registrations, and Enterprise Applications within secure cloud environments.
• Hybrid Identity Management:Manage and monitor hybrid directory architectures usingMicrosoft Entra Connect / Cloud Syncto synchronize on-premises Active Directory with the cloud.
• Conditional Access & MFA:Design, test, and deploy advancedConditional Access policies, Identity Protection risks rules, and phishing-resistant Multi-Factor Authentication (MFA).
• Identity Governance & Lifecycle:Automate user onboarding, transfers, and offboarding workflows using Entra ID Lifecycle Workflows and Access Packages.
• Privileged Access Management:Secure high-privilege administrative accounts usingMicrosoft Entra Privileged Identity Management (PIM), ensuring just-in-time and just-enough access.
• Protocol & Token Management:Configure application federation, Single Sign-On (SSO), and token custom claims usingSAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
• Automation & Scripting:Develop and maintain automation scripts usingMicrosoft Graph PowerShelland Graph API to manage identity objects and generate custom compliance reports.

Required Qualifications

• Security Clearance:Active TS/SCI clearancerequired at the time of application. Must possess a currentCounterintelligence (CI) Polygraphor be willing to take and pass one upon hire.
• Work Arrangement:Ability to work100% on-siteand reliably commute/travel to various work locations across DC, MD, and VA.
• Experience:8+ years of engineering experience focused heavily on theMicrosoft IAM platform.
• Core Systems:Deep technical knowledge ofActive Directory Domain Services (AD DS), Group Policies (GPOs), and Microsoft Entra ID.
• Protocols:Strong understanding of Kerberos, NTLM, LDAP, SAML, and OIDC protocols.
• Automation:Proficiency withPowerShelland direct experience querying the Microsoft Graph API.
• Security Controls:Practical experience implementing Entra ID PIM, Conditional Access, and Role-Based Access Control (RBAC).

Preferred Qualifications

• Certifications:Microsoft Certified:Identity and Access Administrator Associate (SC-300)or Microsoft Certified: Cybersecurity Architect Expert (SC-100).
• DoD 8570/8140 Compliance:Hold an active IAM Level II or III baseline certification (e.g., Security+, CISSP, CISM).
• Cloud Security:Broad familiarity with the wider Microsoft Security ecosystem (Microsoft Defender for Identity, Entra Permissions Management).
• Infrastructure as Code:Experience managing Azure resources using Bicep, ARM templates, or Terraform.
• Competitive health, dental, and vision insurance.
• 401(k) matching and profit-sharing plans.
• Travel/commuter assistance or mileage reimbursement policy for multi-site local travel (where applicable).
• Generous paid time off (PTO) and federal holiday schedule.
• Tuition assistance and dedicated budget for professional certifications (e.g., Microsoft, SANS, CISSP).