Senior IAM Architect — Remote, Zero Trust & Fed-Ready

ICF

Annapolis (MD)

Hybrid

USD 108,006 - 183,610

Full time

7 days ago

Be an early applicant

Get more replies from employers

Send a job-specific resume in minutes.

Job summary

ICF is seeking an IAM Lead to architect, implement, and operate the identity and access management platform for a federal technology program. You will own the full identity lifecycle from onboarding automation to privileged access controls and external identity federation.

The role is remote-friendly with occasional onsite requirements in the Washington, DC Metro area. You will work in a cloud-first, Zero Trust environment and collaborate with cybersecurity and enterprise architecture teams on

Qualifications

Bachelor's degree or equivalent.
7+ years of identity and access management engineering experience.
3+ years designing and operating Entra ID or Okta in production.
2+ years implementing PAM and just-in-time elevation.
2+ years configuring RBAC, PBAC, or ABAC in enterprises.
2+ years supporting federal IT programs in health or federal agencies.

Responsibilities

Architect and maintain identity platforms including Entra ID, Entra External ID, and Okta for authentication, authorization, provisioning, and lifecycle management.
Define and enforce phishing-resistant authentication (passkeys, WebAuthn, biometrics) and move toward passwordless posture.
Implement Zero Trust access rules using risk-based and conditional access policies.
Design and operate RBAC, PBAC, ABAC with least-privilege and fine-grained access rules.
Manage privileged accounts with PAM and just-in-time elevation and log all elevated access.
Automate joiner/mover/leaver workflows, provisioning, license assignment, access revocation based on HR events.
Federate external identities with partners and contractors using Entra External ID and consent workflows.
Coordinate with security/compliance on NIST IAL/AAL requirements and assurance.
Integrate apps with identity platforms using OIDC, OAuth2, SAML, SCIM for SSO and provisioning.
Monitor sign-ins, respond to incidents, and coordinate with cybersecurity for identity-related events.
Maintain identity data quality and synchronisation across directories and HR systems.
Support audits by producing access reports and attestations.
Document architectures, configurations, runbooks and onboarding guidance for central identity platforms.