Senior Identity Security Engineer: Zero-Trust IAM & AI

CoStar Group; Arlington (VA); Hybrid; USD 133,000 - 203,000; Full time

Benefits offered by this job

Healthcare

401(k) matching

Tuition reimbursement

On-site fitness center

Job summary

CoStar Group is seeking a Senior Identity Security Engineer to harden controls and empower 8000+ employees to securely access company resources. The role involves implementing a zero-trust, FIDO2 compliant framework, leading multi-platform authentication programs, and collaborating with Security, Systems, DevOps, Network, and Development teams.

Ideal candidates have hands-on experience with identity providers (Okta, PingID, Entra ID, AD), PKI/FIDO2, and SIEM analytics, plus strong scripting

Qualifications

• Bachelor’s degree from an accredited institution.
• 4+ years of hands-on security engineering experience.
• Strong understanding of identity protection and authentication protocols (SAML, OAuth, OIDC).
• Experience administering identity providers (Okta, PingID, Microsoft Entra ID, AD).
• Knowledge of PKI and FIDO2 (passkeys, Windows Hello for Business).
• Experience with SIEM and dashboards.

Responsibilities

• Design, implement, and improve identity security controls across platforms.
• Develop and maintain conditional access policies including privileged roles and workload identities.
• Analyze logs to guide rollouts of security initiatives.
• Support phish-resistant authentication rollout across the org.
• Operate AI-assisted tooling to improve efficiency and surface identity risks.
• Document projects, standards, and runbooks.
• Communicate with technical and non-technical stakeholders.
• Participate in attack path management and stay current on identity threats.

Skills

Identity security

Zero trust

SIEM analysis

Python/PowerShell

Education

Bachelor’s Degree

Tools

Okta

PingID

Microsoft Entra ID

Active Directory

Job description

CoStar Group is seeking a Senior Identity Security Engineer to harden controls and empower 8000+ employees to securely access company resources. The role involves implementing a zero-trust, FIDO2 compliant framework, leading multi-platform authentication programs, and collaborating with Security, Systems, DevOps, Network, and Development teams.

Ideal candidates have hands-on experience with identity providers (Okta, PingID, Entra ID, AD), PKI/FIDO2, and SIEM analytics, plus strong scripting