Zero Trust Security Engineer - Okta

The Amatriot Group; Quantico (VA); Hybrid; USD 120,000 - 145,000; Full time

Job summary

The Amatriot Group is hiring a Zero Trust Security Engineer – Okta to support the DCSA program in Quantico, VA. The role administers, configures, maintains, and integrates the Okta Identity Cloud to ensure secure access to DCSA applications and resources, using SSO, MFA, and lifecycle management.

Candidates should have 5+ years hands-on Okta experience, active Top Secret clearance with TS upgrade eligibility, and 8570 IAT Level II certifications.

Qualifications

• Bachelor’s degree in Cybersecurity, Information Systems Management, or related field, or equivalent military service and/or 5+ years of relevant work experience.
• Minimum of 5 years hands-on experience administering, configuring, and supporting Okta Identity Cloud in enterprise or federal environments.
• Strong understanding of identity-centric security, directory services (AD/LDAP), and federation protocols (SAML 2.0, OIDC, OAuth 2.0).
• Ability to communicate complex technical ideas to diverse audiences in writing and speech.
• Meet 8570 IAT Level II certification requirements at time of hire (e.g., Security+ CE, CCNA Security, CySA+, etc.).
• Active Top Secret clearance and eligibility for upgrade to TS/SCI.

Responsibilities

• Manage, configure, and maintain daily operations of Okta Identity Cloud (Universal Directory, SSO, MFA).
• Develop, implement, and enforce granular sign-on policies and adaptive MFA.
• Design, implement, and troubleshoot automated provisioning and lifecycle workflows across applications.
• Configure Okta Workflows; use PowerShell and Python to automate IAM tasks.
• Integrate Okta with Active Directory, LDAP, HR systems, AWS, and Azure AD; onboard SaaS and on-prem apps using SAML, OIDC, WS-Fed, SCIM.
• Collaborate with cybersecurity teams to integrate Okta logs with SIEM tools like Splunk.
• Create and maintain runbooks, SOPs, architecture diagrams, and user guides.
• Train and mentor junior staff on Okta troubleshooting and identity lifecycle actions.

Skills

Identity security

Directory services

Federation protocols

SAML 2.0

OIDC

OAuth 2.0

Communication

Education

Bachelor’s degree or equivalent

Tools

Okta Identity Cloud

Job description

Location: Quantico, Va. Hybrid 2 days onsite.

Security Clearance: Active TS or higher [Required]

Job Type: Full-Time

Target Salary Range*: $120,000 - $145,000

• This represents the potential salary range for this position depending on education level, years of experience and/or certifications in addition to other position specific requirements which may impact salary

Position Overview

Amatriot is hiring a Zero Trust Security Engineer – Okta to support its Defense Counterintelligence and Security Agency (DCSA) program in Quantico, VA 22134, USA. The role administers, configures, maintains, and integrates the Okta Identity Cloud platform to ensure secure, seamless, and compliant access to DCSA applications and resources. It uses Single Sign-On (SSO), Multi-Factor Authentication (MFA), Lifecycle Management (LCM), Universal Directory, and Okta Workflows to support Zero Trust architecture and secure the hybrid workforce.

Key Responsibilities

• Manage, configure, and maintain daily operations of Okta Identity Cloud, including Universal Directory, SSO, and MFA.
• Develop, implement, and enforce granular sign-on policies, adaptive MFA, and application-level access controls.

Lifecycle Management and Automation

• Design, implement, and troubleshoot automated provisioning, deprovisioning, and user lifecycle workflows across target applications.
• Configure Okta Workflows or use scripting tools such as PowerShell and Python to automate manual IAM tasks and onboarding processes.

Directory and Application Integration

• Integrate Okta with authoritative source directories, including Active Directory, LDAP, and HR systems, and cloud environments such as AWS and Azure AD.
• Onboard and integrate SaaS, web-based, and legacy on-premises applications using SAML, OIDC, WS-Fed, and SCIM protocols.

Security and Compliance Integration

• Collaborate with cybersecurity teams to integrate Okta system logs with SIEM tools such as Splunk for security monitoring and audit reporting.
• Support Zero Trust implementation by aligning Okta authentication policies with endpoint posture assessment tools, including Palo Alto GlobalProtect and crowd-sourced agents.

Troubleshooting and Support

• Serve as the Tier 2/Tier 3 subject matter expert for Okta issues, troubleshooting authentication failures, provisioning errors, federation mismatches, and user access problems.

Documentation and Training

• Create and maintain engineering runbooks, standard operating procedures (SOPs), architecture diagrams, and user guides.
• Train and mentor junior support technicians and help desk staff on basic Okta troubleshooting and identity lifecycle actions.

QualificationsEducation

• Bachelor’s degree in Cybersecurity, Information Systems Management, or a related field, or an equivalent combination of military service and/or at least five (5) years of significant, relevant work experience. [Required]

Experience

• Minimum of 5 years of hands-on experience administering, configuring, and supporting Okta Identity Cloud in an enterprise or federal environment. [Required]

Skills

• Strong understanding of identity-centric security, directory services such as Active Directory and LDAP, and modern federation protocols, including SAML 2.0, OIDC, and OAuth 2.0. [Required]
• Ability to communicate complex technical ideas to a diverse customer base verbally and in writing. [Required]

Certifications

• Meet 8570 IAT Level II certification requirements at the time of hire, such as Security+ CE, CCNA Security, CySA+, GICSP, GSEC, SCCP, or a higher-tier 8570 certification. [Required]

Clearance

• Active Top Secret clearance and eligibility for an upgrade to TS/SCI. [Required]

Working Conditions

• Primarily a telework position, with a requirement to be onsite at least two (2) days a week or as needed at Quantico Marine Corps Base, VA. Additional onsite time may be required during initial onboarding and program integration. [Required]
• If the alternate worksite is outside DCSA facilities or corporate office space, reliable voice communication capability and a stable, capable internet connection are required. [Required]

Preferred QualificationsCertifications

Official Okta certifications are highly desired:

• Okta Certified Professional.
• Okta Certified Administrator.
• Okta Certified Consultant or Okta Certified Developer.

Alternate Worksite Communication

• Cell phone for voice communication when working outside DCSA facilities or corporate office space.