Identity & Access Management Engineer (PAM / Active Directory)

Eligibility: Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation) - no active clearance required., The ideal candidate is a Microsoft infrastructure engineer at heart, with years of on-premises Active Directory work behind them and hands-on time deploying privileged access tools. Previous experience with BeyondTrust Privileged Remote Access or Password Safe, Active Directory migrations or consolidations in environments with tens of thousands of users, ADFS or Microsoft certificate services, Microsoft certifications such as MCSE, and work in OT, industrial control system, or isolated network environments., * Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation; no active clearance required). \n

• Strong technical writing and communication skills, with the ability to explain identity and access decisions to both technical and non-technical audiences. \n

• 5+ years of IT or cybersecurity engineering experience, including 2+ years of hands-on on-premises Active Directory engineering. \n

• Hands-on deployment of BeyondTrust in a large environment, including password vaulting. \n

• Hands-on on-premises Active Directory engineering in a large enterprise (e.g., forest and domain design, group policy, privileged account tiering). \n

• Experience integrating Active Directory with Okta for SSO and MFA, using protocols such as SAML, OIDC, Kerberos, and LDAP. \n

• Experience with credential rotation and session monitoring. \n

n \n

• Design and deploy BeyondTrust Privileged Remote Access across a large, multi-site operational technology environment. \n

• Integrate privileged access with Active Directory and Okta for secure, seamless authentication. \n

• Build least-privilege and just-in-time access workflows, with password vaulting for privileged accounts. \n

• Configure session recording and audit logging that feed the central SIEM. \n

• Engineer resilient access that keeps working when sites lose connectivity, backed by tested recovery plans. \n

• Harden and maintain the PAM platform for performance and availability across every site. \n

• Produce the designs, runbooks, and security documentation that carry the system through approval (ATO). \n

\n

\n, n \n

• Compensation: $150k-$185k annually (depending on experience) \n

• Company health plan \n

• 401(k) plan with employer match \n

• Paid holidays and paid time off \n

• Education reimbursement \n

\n

\n

Signal Hill Technologies is seeking a Senior IAM Engineer to design and deploy privileged remote access for a large federal critical-infrastructure client. As one of the first engineers on the program, you will own the privileged access capability from design through production rollout. You will build audited administrative access to OT assets at distributed sites, tied into enterprise Active Directory and Okta, that keeps working locally when a site loses its connection to central services.

\n

\n

Also known as a Privileged Access Management (PAM) Engineer, IAM Engineer, Identity Architect, Active Directory Engineer, or Cybersecurity Engineer, you’ll bring the identity focus to a hands-on cyber engineering role, working alongside our SIEM, PKI, and systems engineers.

\n

\n

You’ll also be a trusted technical voice with the client’s IT, CISO, networking, and system-owner teams. Getting a new capability through formal approval and into daily use is its own kind of engineering challenge, and doing it well is a real part of the job., Founded and led by veteran cyber operators, Signal Hill Technologies delivers advanced cybersecurity solutions to DoD, Intelligence Community, financial services, and critical infrastructure clients, with many years of experience defending both US Government and commercial clients against sophisticated, well-funded, motivated adversaries. We are relentless about real results and operationally proven expertise. Our mission is to provide the best technical solutions and hands-on support to address each customer’s unique cyber risks.