Remote Cloud IAM Engineer - GCP & Zero-Trust

CACI International Inc.; United States; Remote; USD 105,100 - 231,100; Full time

Job summary

CACI International Inc. invites an IAM Engineer to architect and scale large-scale, cloud-native authorization services on GCP for the SOCEUR HTAP ecosystem. You will design core identity federation, access policies, and security boundaries that protect mission-critical data.

Collaborate with cybersecurity, developers, and platform engineers to implement zero-trust, RBAC, MFA, and CAC/PIV integration, while auditing IAM resources and enforcing least-privilege access.

Qualifications

• 5+ years in backend or security engineering focusing on IAM on cloud platforms.
• Strong knowledge of SAML, OAuth, OIDC and identity providers.
• Experience with Keycloak, Google Cloud Identity, and MFA integration.
• Proficient in IaC with Terraform to codify IAM resources.
• Experience with CAC/PIV and PKI.

Responsibilities

• Architect and scale distributed cloud-native IAM services on GCP.
• Design identity federation between on-prem/external IdPs and Google Cloud Identity.
• Implement RBAC, MFA, and zero-trust access policies.
• Audit IAM configurations and service accounts; support incident response.
• Collaborate with security, dev, and platform teams.

Skills

Backend software engineering

IAM security engineering

Cloud architecture

Zero-trust security

RBAC and MFA

SAML/OIDC

Python/Go/C++

Education

Bachelor's degree in Computer Science or Cybersecurity

Tools

Terraform

Keycloak

Google Cloud IAM

Google Workspace

CAC/PIV integration

Job description

CACI International Inc. invites an IAM Engineer to architect and scale large-scale, cloud-native authorization services on GCP for the SOCEUR HTAP ecosystem. You will design core identity federation, access policies, and security boundaries that protect mission-critical data.

Collaborate with cybersecurity, developers, and platform engineers to implement zero-trust, RBAC, MFA, and CAC/PIV integration, while auditing IAM resources and enforcing least-privilege access.