ICAM Security Engineer

Our client, a leading Government Systems Integrator, is in need of an ICAM Security Engineer for an initial 12 contract. This is a hybrid schedule consisting of 3 days onsite and 2 days remote with candidates being located in either Gaithersburg, MD, Egg Township, NJ or Eagan, MN. The ICAM Security Engineer will be responsible for implementing the identity, credential and access management (ICAM) layer that governs every user and service interaction within the customer platform. They will also be responsible for integrating platform services with government provided ICAM services using OAuth 2.0 and OpenID Connect, including token issuance, validation and claims mapping, implementing and maintaining identity federation user stores (Keycloack or equivalent), including role-based test account provisioning, implementing per-session authentication and authorization for user-to-service and service-to-service requests, implementing mutual TLS (mTLS), service mesh / workload identity and certificate lifecycle management (issuance, rotation, expiration monitoring and revocation) and implementing API gateway authorization.

• At least 4 years of experience with a bachelor’s degree.
• Hands on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection and claims mapping.
• Experience with enterprise identity providers and federation preferrable with Keycloak, Okta, Ping, Microsoft Entra ID or a similar tool.
• Experience implementing RBAC and / or ABAC within distributed applications.
• Knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS) and / or service mesh identity.
• Understanding of Zero Trust principles, including per-session authorization and default-deny service communication.
• Experience implementing audit logging for access and authorization events.
• Proficiency in Java, Python, Go or a similar scripting language.
• Prior experience with Kubernetes and containerized service deployments.

Desired Skills:

• Security + CE, CySA+ or equivalent DOD 8570 IAT Level II certification.
• Federal ICAM / FICAM experience, including PIV / CAC or agency ICAM integration experience.
• Experience with SAML 2.0, SCIM provisioning, Kubernetes RBAC, workload identity (SPIFFE / SPIRE) and / or service mesh (Istio, Linkerd).

ClearBridge Technology Group is an Equal Opportunity Employer. We offer excellent benefits and compensation packages. The expected hourly rate range for this role is $52 - 76/ hr. The posted range is an estimate. The actual compensation offer will be based on the candidate’s experience, skills, qualifications and will be in line with internal equity.