Principal Identity Access and Zero Trust Architect - TS/SCI with Polygraph

General Dynamics IT; Chantilly (VA); On-site; USD 150,000 - 190,000; Full time

Benefits offered by this job

401K with company match

Competitive pay

Paid time off

Job summary

General Dynamics IT seeks an Enterprise Identity and Access Architect to design and own identity architectures across a major DoW program. You will balance strong security with a seamless user experience while reducing risk from authentication friction.

You will define identity principles, lead authentication-flow design, and partner with cloud, network, and app teams to ensure integrated identity decisions across enterprise systems.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field or equivalent.
• 10+ years in identity, security, directory, or enterprise infrastructure.
• 5+ years in identity/access architecture and hands-on AD/Entra ID knowledge.
• Experience with SAML/OAuth/OpenID Connect and PKI.
• Knowledge of RMF/NIST controls and security incident response.

Responsibilities

• Define enterprise identity principles, target architecture, and patterns.
• Lead authentication-flow analysis for mission applications and session behavior.
• Design integration between network access policy and identity posture.
• Develop identity lifecycle controls for onboarding, termination, and entitlements.
• Review designs for authentication, authorization, secrets, and auditability.
• Define logging, monitoring, anomaly detection, and incident-response requirements.
• Collaborate with cloud, network, and service architects to ensure integrated identity decisions.
• Support RMF/ATO artifacts and Zero Trust maturity evidence.

Skills

Active Directory

Identity Access Management

Zero Trust

Education

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field

Tools

Cisco ISE

Microsoft Entra ID

Job description

Type of Requisition: Regular

Clearance Level Must Currently Possess: Top Secret SCI + Polygraph

Clearance Level Must Be Able to Obtain: Top Secret SCI + Polygraph

Public Trust/Other Required: None

Job Family: IT Infrastructure and Operations

Job Qualifications:

Skills:

Active Directory (AD), Identity Access Management (IAM), Zero Trust Certifications:

None Experience:

10 + years of related experience US Citizenship Required:

Yes

Job Description

GDIT is seeking an Enterprise Identity and Access Architect to lead the design and ownership of identity, authentication, authorization, privileged access, and Zero Trust access architectures across a major Department of War Program. This role is responsible for balancing robust security with a seamless user experience; ensuring identity controls reduce risk without introducing repetitive authentication, session disruptions, or operational workarounds.

Key Responsibilities

• Define enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities.
• Lead authentication-flow analysis and design for single-session mission applications, including token/session behavior, step-up authentication, timeout, reauthentication, and fallback.
• Design integration between Cisco ISE network access policy and Microsoft identity/device-compliance posture, including trust, claims, attributes, policy decision points, and failure behavior.
• Develop identity lifecycle controls for onboarding, transfer, termination, recertification, entitlements, privileged roles, service accounts, certificates and automation identities.
• Review application and platform designs for authentication, authorization, secrets, token handling, least privilege, separation of duties, session security, and auditability.
• Define identity-related logging, monitoring, anomaly detection, evidence, and incident-response requirements with Security, Observability, and Service Operations.
• Partner with cloud, EUC, network, application, and ServiceNow architects to ensure identity decisions are integrated rather than locally optimized.
• Support RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness for identity capabilities.
• Lead identity architecture reviews, resolve cross-team policy conflicts, mentor engineers, and brief Government stakeholders on risk/user-experience trade-offs.

Required Qualifications

• Education: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field, or approved equivalent experience.
• Location: Onsite
• Clearance: Active TS/SCI with Polygraph
• 10+ years of identity, security, directory, or enterprise infrastructure experience, including 5+ years in identity/access architecture.
• Deep hands-on knowledge of Active Directory and Microsoft Entra ID, including federation/synchronization, Conditional Access, RBAC, PIM, MFA, device identity, and hybrid identity.
• Strong understanding of Zero Trust, identity-centric access, least privilege, continuous evaluation, device posture, and policy enforcement.
• Experience designing authentication and authorization for enterprise and mission applications using SAML, OAuth 2.0, OpenID Connect, Kerberos, certificates, or comparable mechanisms.
• Experience with privileged-access management, identity governance/recertification, service accounts, secrets, PKI, and non-person entities.
• Experience with Cisco ISE or a comparable NAC platform and integration between network access and enterprise identity/device posture.
• Working knowledge of RMF, NIST controls, STIGs, audit logging, incident response, classified data boundaries, and ATO impacts.
• Demonstrated technical leadership, structured decision-making, conflict resolution, mentoring, and ability to explain identity trade-offs to non-specialists.

Preferred Qualifications

• Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert, CISSP and role-relevant ISSAP, ISSEP or CCSP.
• Experience with M365 GCC/GCC High, Azure Government, AVD, Intune, Defender, and mission-app integration in DoW/IC environments.
• Experience implementing single sign-on or session consolidation for high-security applications with measurable reduction in user friction.
• Experience integrating identity telemetry with Sentinel, Splunk/Elastic, Dynatrace, ServiceNow, or security analytics.
• Prior IC experience and familiarity with cross-domain or multi-enclave identity constraints.

GDIT IS YOUR PLACE

At GDIT, the mission is our purpose, and our people are at the center of everything we do.

• Growth: AI-powered career tool that identifies career steps and learning opportunities
• Support: An internal mobility team focused on helping you achieve your career goals
• Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time o