Identity Infrastructure Engineer (Hybrid) – PAM & Zero Trust

ECS; Fairfax (VA); Hybrid; USD 130,000 - 180,000; Full time

Benefits offered by this job

null

Job summary

Everforth ECS is seeking an Identity Infrastructure Engineer to join our Fairfax, VA team in a hybrid capacity. You will own the health, integrity, and security of our identity backbone, administering Active Directory, PKI, and identity lifecycle across thousands of users and systems.

The role demands hands-on expertise, clear communication, and a focus on security controls. You will implement RBAC across EntraID, AWS, NGINX, AppGate, and Keycloak, enforce least privilege, and manage PAM, access

Qualifications

• Must be a U.S. citizen with DoD Secret clearance.
• 6+ years in Identity and Access Management in complex enterprise or federal environments.
• Active certifications: DoD 8140 IAT II Security+, AWS Certified Solutions Architect – Associate, AZ-104 or AZ-800.
• Hybrid work capability in Fairfax, VA (up to 3 days in office).
• Strong knowledge of AppGate SDP architecture and Keycloak admin interfaces.
• Experience with EntraID/Azure AD, IAM policies, and Zero Trust concepts.
• Proficient in SAML, OpenID Connect, LDAP, MFA and related IAM protocols.
• Ability to translate business access needs into documented security requirements.
• Experience onboarding users, endpoints, applications, and network resources.
• Proven track record conducting access reviews, audits, and compliance reporting.
• Excellent written and verbal communication with diverse stakeholders.
• Federal ICAM policies familiarity and RBAC design expertise.

Responsibilities

• Design and implement an RBAC framework across EntraID, AWS, NGINX, AppGate, and Keycloak.
• Enforce least-privilege policies aligned with Zero Trust and federal directives.
• Validate access controls against Zero Trust requirements.
• Develop identity lifecycle processes from joiners to leavers.
• Lead PAM program governance, monitoring, and privileged account management.
• Conduct access reviews and PAR/RAR reporting to support compliance.
• Create role-to-privilege mappings and function definitions to reduce ambiguity.
• Collaborate with program leadership to align IAM policies with organizational changes.
• Support AppGate SDP Zero Trust Network Access implementation and operations.
• Translate user, application, device, and connectivity needs into access-control requirements.
• Assist senior engineers with identity-based, least-privilege policy design.
• Onboard users and network resources; maintain IAM metrics and dashboards.
• Act as IAM SME for program compliance activities and government engagements.

Skills

U.S. Citizen

DoD Secret clearance

Identity & Access Management

6+ years IAM experience

RBAC design

Zero Trust Architecture

Microsoft EntraID / Azure AD

AWS IAM

AppGate SDP

Keycloak

Active Directory

Networking fundamentals

SAML / OpenID Connect

PAM / privileged access

Documentation & communication

Education

High School Diploma

Tools

AppGate SDP

Keycloak Admin Console

Azure AD / EntraID

Active Directory

NGINX

Job description

Everforth ECS is seeking an Identity Infrastructure Engineer to join our Fairfax, VA team in a hybrid capacity. You will own the health, integrity, and security of our identity backbone, administering Active Directory, PKI, and identity lifecycle across thousands of users and systems.

The role demands hands-on expertise, clear communication, and a focus on security controls. You will implement RBAC across EntraID, AWS, NGINX, AppGate, and Keycloak, enforce least privilege, and manage PAM, access