Lead Identity and Access Management (ICAM) Engineer

Leidos; Rockville (MD); On-site; USD 131,000 - 237,000; Full time

Job summary

Leidos is seeking an expert-level Lead Identity and Access Management Engineer to serve as the senior technical authority for enterprise IAM solutions supporting large-scale government digital initiatives.

The candidate will architect, implement, and mature IAM across cloud and on-premises environments, providing leadership, mentorship, and strategic guidance while ensuring compliance and security best practices.

Qualifications

• Bachelor's degree required, plus 12+ years general experience; Masters reduces years requirement.
• 8+ years in identity and access management.
• 5+ years in senior/lead or SME capacity.
• Hands-on with at least two IAM platforms from categories (IGA, PAM, SSO/Federation, Directory Services).
• Experience with cloud IAM services (Azure Entra ID, AWS IAM/SSO, GCP IAM).
• Experience with authentication protocols (SAML, OAuth 2.0, OIDC).
• Microsoft identity solutions experience (Entra ID, AD FS, M365, MIM).
• Experience in large-scale AD and Entra ID architectures.

Responsibilities

• Lead design, engineering, and continuous improvement of enterprise IAM solutions (IGA, PAM, SSO, MFA).
• Serve as SME for IAM architecture decisions and integration strategy across cloud and on-premises platforms.
• Define and enforce identity lifecycle management, RBAC/ABAC, and least privilege.
• Lead IAM audits, risk assessments, and remediation; ensure regulatory compliance.
• Partner with security operations, owners, and compliance to integrate apps into IAM platforms.

Skills

IAM architecture

Cloud & on-prem IAM

SAML 2.0 / OAuth 2.0 / OIDC

PowerShell / Graph API

Regulatory compliance

Education

Bachelor's degree in computer science or IT

Master's degree (preferred)

Tools

Microsoft Entra ID

Azure AD

Okta

Ping Identity

CyberArk

Active Directory / Entra ID

Job description

Description

Leidos Digital Civilian Agency Solutions division is seeking an expert-level Lead Identity and Access Management Engineer to serve as the senior technical authority for complex enterprise identity management solutions for large-scale government digital transformation initiatives. The ideal candidate will have deep expertise in Microsoft identity technologies and a proven track record of designing, implementing, and maturing IAM architecture and processes across cloud and on-premises environments, ensuring alignment with industry frameworks and regulatory requirements, and provides technical leadership and mentorship to junior and mid-level IAM engineers. advanced enterprise-level identity solutions.

Candidate MUST

Be a US Citizen or US Person who has lived in the United States for at least three consecutive years and have the ability to obtain a Public Trust level 4 clearance

Primary Responsibilities

• Lead the design, engineering, and continuous improvement of enterprise IAM solutions, including Identity Governance and Administration (IGA), Privileged Access Management (PAM), Single Sign-On (SSO)/Federation, Multi-Factor Authentication (MFA), and directory services.
• Serve as the SME for IAM architecture decisions, tool selection, and integration strategy across cloud (Azure, AWS, GCP) and on-premises platforms.
• Define and enforce Identity lifecycle management processes (joiner-mover-leaver), role-based/attribute-based access control (RBAC/ABAC), and least-privilege principles.
• Lead IAM-related audits, risk assessments, and remediation efforts; ensure compliance with regulatory and contractual obligations.
• Partner with security operations, application owners, and compliance teams to integrate applications into enterprise IAM platforms (e.g., Microsoft Entra ID/Azure AD, Okta, Ping Identity, CyberArk).
• Provide technical leadership, mentoring, and peer review for IAM engineering staff.
• Support incident response and forensic investigations involving identity-related events.
• Evaluate emerging IAM technologies (e.g., password less authentication, decentralized identity, Zero Trust architecture) and recommend adoption strategies.
• Prepare technical documentation, architecture diagrams, and executive-level reporting on IAM posture and roadmap.

Required Qualifications

• Bachelors degree in computer science, Information Technology, or equivalent and 12 years of general experience, preferably supporting system engineering. 6 years of additional experience is equivalent to a Bachelors degree. With a Masters degree, 10 years of general experience is required.
• 8+ years of progressive experience focusing on identity and access management.
• 5+ years in a senior/lead or SME capacity, with demonstrated ownership of enterprise-scale IAM architecture.
• Hands-on experience with at least two of the following IAM platform categories:
• IGA: Microsoft Identity Manager
• PAM: CyberArk, Beyond Trust
• SSO/Federation: Okta, Microsoft Entra ID, Ping Identity
• Directory Services: Active Directory, Azure AD/Entra ID, LDAP
• Experience supporting federal, defense, or highly regulated environments preferred (especially for government/contractor roles).
• Experience with cloud IAM services (Azure Entra ID, AWS IAM/SSO, GCP IAM).
• Deep understanding of authentication and authorization protocols: SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), SCIM, Kerberos.
• Extensive hands-on experience with Microsoft identity solutions (Entra ID, AD FS, Microsoft 365, MIM).
• Proven experience in large-scale, multi-forest Active Directory and Entra ID architectures.
• Advanced knowledge of identity protocols (SAML, OAuth 2.0, OpenID Connect, WS-Federation, CBA).
• Strong experience with Entra B2B and B2C for external identity management.
• Experience with Entra AD Connect, including custom synchronization rules.
• Strong proficiency in PowerShell and Graph API for identity management automation.
• Familiarity with Zero Trust architecture and identity-related security best practices.

Preferred Qualifications

• Relevant certifications, hold at least one or two of the following, aligned to seniority:
• CIAM (Certified Identity and Access Manager) or CIGE (Certified Identity Governance Expert)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• CyberArk Defender/Sentry/Guardian
• Okta Certified Professional/Consultant/Administrator
• Ping Identity Certified Professional
• CompTIA Security+
• Knowledge of identity-related compliance standards (e.g., NIST, FISMA, SOC, FedRamp).
• Experience with Azure AD Verifiable Credentials and decentralized identity concepts.
• Understanding of biometric authentication methods and their Azure AD integration.

About Leidos

Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations. Headquartered in Reston, Virginia, with 47,000 global employees, Leidos reported annual revenues of approximately $16.7 billion for the fiscal year ended January 3, 2025. For more information, visit www.Leidos.com.

Pay Range

Pay Range $131,300.00 - $237,350.00