> Markdown version of [/jobs/ext/2954357-senior-zero-trust-identity-and-icam-engineer](https://www.wearedevelopers.com/jobs/ext/2954357-senior-zero-trust-identity-and-icam-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Senior Zero Trust Identity and ICAM Engineer

- **Company:** CELESTIAL LLC
- **Location:** Washington, DC, United States (Remote available)
- **Experience:** Expert
- **Salary:** $150,000.0 - $185,000.0
- **Contract:** Permanent contract
- **Skills:** Microsoft Access, Active Directory, Amazon Web Services, Application Layers, Systems Engineering, ARM Architecture, User Authentication, Microsoft Azure, CompTIA Security+, Cyber Security, System Configuration, Data Governance, Domain Name System Security Extensions, Multi-Factor Authentication, Federal Information Processing Standards (FIPS), Identity and Access Management, Intrusion Detection and Prevention, Virtual Private Networks (VPN), Network Security, Lightweight Directory Access Protocols (LDAP), System Center Configuration Manager, Network Segmentation, Public Key Infrastructure, Role-Based Access Control, Azure Active Directory, Zero Trust Network Access, Salesforce.Com, Security Information and Event Management, Smart Cards, Software Vulnerability Management, Wide Area Networks, Wireless Networks, Transport Layer Security, Cloud Platform System, Workspace ONE, HybridCloud, Togaf, Microsoft InTune, Information Technology, Cybercrime, Palo Alto Networks, Data Analytics, Microsoft Sentinel, Sumo Logic (Software), Prisma Cloud Platform, DODAF, Cisco, Qualys, Servicenow
- **Published:** September 17, 2026
- **Apply:** https://www.careerjet.com/job/usbb0a42427fa65921eb27b5cb9af0951b/eaa

## About the Role

* 7+ years of experience in cybersecurity engineering, network security, or IT infrastructure roles
 * 5+ years of hands-on experience designing or implementing Zero Trust Architecture in an enterprise or federal environment
 * Demonstrated understanding of ZTA concepts across all five pillars per NIST SP 800-207 and the CISA Zero Trust Maturity Model
 * Experience supporting federal government clients or DoD/civilian agency environments, * Proficiency in at least one of the following: Palo Alto Prisma, Zscaler, or Microsoft Zero Trust stack
 * Identity and access management: Entra ID, Active Directory, LDAP, PKI, MFA, PAM tooling; Federal PKI/ICAM experience, with demonstrated hands-on PIV/PIV-I Smartcard credential issuance and lifecycle management
 * Intercede MyID CMS Enterprise architecture and deployment: hands-on experience designing, deploying, configuring, and operating Intercede MyID CMS Enterprise, including credential profiles, enrollment workflows, Smartcard issuance, certificate provisioning, renewal, revocation, and integration with PKI and enterprise identity services
 * Microsoft Entra Certificate Based Authentication (CBA)
 * Network security: microsegmentation, ZTNA, DNS security, SD-WAN, next-generation firewall policy
 * Endpoint security: EDR/XDR deployment and management, device compliance policy enforcement
 * Cloud environments: Azure, AWS, or hybrid cloud architectures with ZTA overlay
 * Familiarity with SIEM/SOAR platforms (Microsoft Sentinel, SumoLogic, Google SecOps, or equivalent), * Active certifications in one or more ZTA vendor platforms: PCCSE, PCNSE, Zscaler ZCCA-IA or ZCCA-PA, Microsoft SC-100 (Cybersecurity Architect Expert)
 * Additional certifications: CISSP, CISM, CompTIA Security+, Cloud+ or relevant AWS/Azure security certifications
 * Familiarity with RMF processes: NIST SP 800-37, SSP authoring, ATO package preparation
 * Experience with ServiceNow, Salesforce, or IT service management tooling in a federal context
 * Multi-vendor ZTA integration experience (e.g., combining Palo Alto and Zscaler capabilities within a single architecture)

## Description

Celestial Innovations Group (CIG) is seeking a Zero Trust Identity and ICAM Engineer to own end-to-end access policy design across the identity, endpoint, network, and application layers for federal agency clients, spanning the design, implementation, and sustainment of Zero Trust Architecture (ZTA) programs. This role is framework-agnostic and vendor-informed: the ideal candidate understands that Zero Trust is a security philosophy and architectural strategy, not a single product or platform, guided by the principle of "never trust, always verify." The engineer will apply that expertise across one or more leading vendor ecosystems to deliver compliant, mission-ready ZTA solutions aligned with federal mandates including EO 14028, OMB M-22-09, NIST SP 800-207, and the CISA Zero Trust Maturity Model and Secure Access Service Edge (SASE) guidance.
These responsibilities and strategies are currently shared across three teams and, as a result, are owned by none of them. Current cyber threats require aligning, consolidating, and bridging access control strategies and policies into a unified front, acting as Trust Brokers across the enterprise, so the organization can maintain a strong security posture ahead of adversaries.
Must be located in the DC Metro Area as this role requires onsite and remote support., Architecture and Strategy

 * Lead Zero Trust Architecture assessments, gap analyses, and roadmap development for federal clients
 * Design and document ZTA solutions spanning all five pillars: Identity, Device, Network, Application/Workload, and Data
 * Translate federal ZTA mandates (EO 14028, OMB M-22-09, CISA ZT Maturity Model) into actionable implementation plans
 * Develop architecture artifacts including conceptual, logical, and physical ZTA diagrams using DODAF, TOGAF, or equivalent frameworks
 * Support integration of ZTA principles into existing enterprise architectures, hybrid cloud environments, and multi-tenant federal networks
 * Drive SASE convergence, consolidating network and security enforcement onto a single policy plane
 * Advance security posture design and real-time trust evaluation, with a focus on insider threat detection and response

Implementation and Engineering

 * Deploy and configure Zero Trust solutions across one or more vendor platforms (see Vendor Ecosystem section below)
 * Own top-level Conditional Access policy design and privileged access governance in Microsoft Entra ID/M365
 * Implement Identity and Access Management controls including CAC/PIV authentication, MFA, role-based access control (RBAC), and Just-in-Time (JIT) Privileged Access Management
 * Deliver Enterprise Identity, Credential, and Access Management (ICAM) support services, with priority focus on PIV-enabled logical access implementation across enterprise systems
 * Enforce device posture as a condition of every access decision, integrating SCCM, Intune, Workspace ONE (WS1), Purview, Qualys, and Palo Alto NGFW signals
 * Define and enforce application-layer access policy and decisions across M365, Palo Alto NGFW, Entra ID, and Workspace ONE (WS1)
 * Configure microsegmentation, Zero Trust Network Access (ZTNA), software-defined perimeters, and DNS security controls across the network landscape, including Palo Alto, Cisco, and wireless infrastructure
 * Deploy Endpoint Detection and Response (EDR) tooling and enforce device compliance policies at enterprise scale
 * Integrate data protection controls including classification, labeling, DLP, and encryption aligned to ZTA data pillar requirements

Compliance and Authorization

 * Align ZTA implementations with NIST SP 800-53 Rev 5, NIST SP 800-207, DISA STIGs, and DHS CDM program requirements
 * Support the Risk Management Framework (RMF) lifecycle, including SSP authoring, continuous monitoring, and ATO maintenance
 * Document ZTA controls for system security packages, POA&Ms, and security assessment reports
 * Own access policy exception management, including governance workflows and audit-ready evidence documentation

Client Engagement and Collaboration

 * Serve as a trusted ZTA advisor to federal agency stakeholders, program managers, and ISSO/ISSM counterparts
 * Produce executive-level briefings, technical white papers, and implementation status reports
 * Collaborate cross-functionally with cloud, networking, data analytics, and infrastructure teams to ensure cohesive ZTA integration, CIG's ZTA practice is solution-agnostic at the architectural level. Engineers are expected to bring deep expertise in at least one of the following vendor platforms, with cross-platform fluency strongly preferred:
Vendor / Framework & Relevant Capabilities
Palo Alto Networks (Prisma): Prisma Access (ZTNA 2.0), Prisma Cloud, Cortex XDR/XSIAM, NGFW policy, SD-WAN integration, threat prevention across all ZTA pillars
Zscaler: Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), Zscaler Digital Experience (ZDX), cloud proxy architecture, VPN replacement, SSL inspection
Microsoft Zero Trust: Microsoft Entra ID (Azure AD), Conditional Access, Intune/MEM, Microsoft Defender suite, Sentinel SIEM/SOAR, Purview data governance, M365 compliance center
CISA ZT Maturity Model: Five-pillar maturity assessment (Traditional, Initial, Advanced, Optimal), cross-cutting capability mapping, agency self-assessment support, roadmap alignment to federal reporting requirements
Additional Enterprise Tooling: SCCM, Workspace ONE (WS1), Qualys vulnerability management, and Cisco network/wireless fabric, supporting device posture and network segmentation enforcement across the landscape, Soltesz is growing, and we are seeking an experienced Senior Project Manager to join our Lanham office. This is an excellent opportunity for a proven civil engineering professional…

 + 1 day ago, MANTECH is seeking a motivated, career-driven, and customer-focused Senior Systems Engineer to join our team in Laurel, MD. You will play a critical role in supporting the enterp…
 + 5 days ago
+


## Related Videos

- [Trust Issues: Because Zero-Trust Isn’t Optional Anymore](https://www.wearedevelopers.com/videos/100089-trust-issues-because-zero-trust-isn-t-optional-anymore)
- [How Cisco embraced a DevOps culture within its network engineering team](https://www.wearedevelopers.com/videos/99-how-cisco-embraced-a-devops-culture-within-its-network-engineering-team)
- [Small, Secure, Interconnected: The next Internet Protocol](https://www.wearedevelopers.com/videos/100062-small-secure-interconnected-the-next-internet-protocol)
- [Computer Vision from the Edge to the Cloud done easy](https://www.wearedevelopers.com/videos/263-computer-vision-from-the-edge-to-the-cloud-done-easy)
- [Your Infrastructure Is Not a Playground: AI Agents for Infra Done Right](https://www.wearedevelopers.com/videos/2084-your-infrastructure-is-not-a-playground-ai-agents-for-infra-done-right)
- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)

## Related Articles

- [How We Built a Worry-Free System That Runs for 10+ Years – And What We’d Do Again](https://www.wearedevelopers.com/magazine/751-how-we-built-a-worry-free-system-that-runs-for-10-years-and-what-we-d-do-again)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [Best US AI Conferences for CTOs in 2026: Build vs. Buy, Vendor Evaluation, and Peer Intelligence](https://www.wearedevelopers.com/magazine/736-best-us-ai-conferences-for-ctos-in-2026-build-vs-buy-vendor-evaluation-and-peer-intelligence)
- [Trustworthy AI Starts at Deployment: 5 Checks Before You Ship](https://www.wearedevelopers.com/magazine/753-trustworthy-ai-starts-at-deployment-5-checks-before-you-ship)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [The Overflow: Security and Privacy](https://www.wearedevelopers.com/magazine/715-the-overflow-security-and-privacy)