Cloud Identity and Security Engineer

Description

The company is looking for a mid-level cloud identity and security engineer to run and automate access governance across hybrid identity systems and AWS cloud environments.

You will apply AAA (authentication, authorization, accounting) controls end to end through Infrastructure as Code in Terraform, covering group memberships, repository permissions, secrets, and enterprise single sign-on across PingFederate, Keycloak, GitLab, AWS Landing Zone Accelerator (LZA), and AWS IAM Identity Center (IDC).

Responsibilities

• Run identity federation and user sign-in flows in PingFederate and Keycloak.
• Connect enterprise identity providers and cloud services using MFA and SSO protocols such as SAML 2.0 and OIDC.
• Create and maintain user accounts, group assignments, and directory memberships on each identity platform.
• Shape fine-grained permissions, roles, and group membership in IAM Identity Center and in GitLab groups and repositories.
• Apply changes to the landing zone through LZA to keep organizational boundaries and Service Control Policies in place.
• Grant only the access each person needs across AWS CodeCommit, development repositories, and cloud workloads.
• Set up and keep current key-value secrets, database credentials, and API keys in AWS Secrets Manager, with automatic rotation and secure access rules.
• Review identity lifecycle steps, repository permissions, and access logs to confirm they meet security baselines.
• Define identity resources, groups, access policies, and cloud infrastructure in Terraform.
• Automate onboarding, offboarding, and permission requests across GitLab, AWS, and PingFederate or Keycloak.

Requirements

• 2+ years of hands-on work in cloud identity management, IAM, or cloud infrastructure operations.
• Working knowledge of federated identity, including SAML and OIDC, and of PingFederate, Keycloak, and AWS IAM Identity Center.
• Strong Terraform skills for provisioning cloud resources, IAM policies, and identity group memberships.
• Practical experience managing GitLab permissions for groups and projects, and working with AWS CodeCommit, AWS Secrets Manager, and AWS Landing Zone Accelerator.
• Good grasp of AAA principles, RBAC and ABAC models, and identity lifecycle management.
• Any of these certifications: AWS Certified Security, Specialty, AWS Certified Solutions Architect, Associate, or Ping Identity or Keycloak.
• A bachelor's degree in computer science, information technology, or a related field.
• US citizenship and an active Top Secret/SCI security clearance are required.

Conditions

Full-time, direct W2 employment only; the company does not work with staffing agencies, C2C, or 1099 contractors for this role.

The estimated salary range is $90,000.00 to $150,000.00, depending on experience and technical skills.

The company is an EEO/AA employer, and all hires must verify identity, confirm US citizenship, and complete employment eligibility verification on hire.