ICAM Automation Engineer

Description

The team is a cybersecurity group building Zero Trust and ICAM automation.

This full-time, regular role supports Cyber 2 operations. You will help design and build secure, scalable workflows that improve the company's security posture.

The work suits someone who likes hard problems, simplifying security operations, and hands-on use of current tools across IAM, SOC automation, and cloud.

Responsibilities

• Build and automate ICAM workflows covering user lifecycle, MFA enrollment, and conditional access policy.
• Create and maintain integrations across Okta, CyberArk, AWS IAM Identity Center, and Active Directory.
• Design Zero Trust policies using Zscaler ZPA and ZIA, AWS Verified Access, and device trust signals.
• Write and improve SOC and Zero Trust automation, including Splunk ES detection rules and Splunk SOAR playbooks.
• Automate actions such as revoking sessions, removing access, rotating credentials, and generating incident tickets.
• Help onboard, parse, and enrich log sources for IAM and security platforms.
• Work with engineering, SOC, and identity teams to improve automation, consistency, and security outcomes.

Requirements

• Required: Hold at least an interim Secret clearance.
• Required: Hold DoD 8140 Foundational Intermediate, 671 System Testing and Evaluation Specialist (tentative).
• Required: Hold one or more of these certifications: CEH, CFR, Cloud+, GSEC, PenTest+, Security+, or SSCP.
• Required: Have 4+ years of experience in IAM automation, security orchestration, or SOC operations.
• Required: Automate Okta through its API, including lifecycle events, MFA workflows, and conditional access.
• Required: Automate CyberArk PAM tasks such as onboarding, credential rotation, and PSM session automation.
• Required: Manage AWS IAM Identity Center permission sets and account assignments through automation.
• Required: Delegate administration and manage groups in AWS Managed Microsoft AD.
• Required: Experience with AD LDS used for partner or external identity stores.
• Required: Create and tune Splunk ES rules.
• Required: Build Splunk SOAR playbooks for ICAM and Zero Trust actions, including user suspension, session revocation, and access removal.
• Required: Build Splunk SOAR playbooks that also handle Zscaler ZPA segment revocation, CyberArk account lock, and automated ServiceNow ticketing.
• Required: Onboard log sources for Okta, CyberArk, Zscaler, and related technologies.
• Required: Understand the PDP, PEP, PIP, and PAP components of Zero Trust architecture.
• Required: Automate Zscaler ZPA (ZTNA) and ZIA (SWG) policies.
• Required: Develop AWS Verified Access policies.
• Required: Integrate device trust and posture signals.
• Desired: Python and/or PowerShell for automation and API development.
• Desired: Troubleshoot SAML 2.0 and OIDC federation.
• Desired: Experience with FIDO2, CAC/PIV, and hardware token authentication workflows.
• Desired: Knowledge of ABAC models, including SAP-specific attributes.
• Desired: Familiarity with myAuth (okta.mil) and DoD IdP integrations.

Conditions

Full-time, regular position.

Secret clearance is required to start.

Travel is up to 10%, local only.

Proposed salary range: $63,300-$129,700.

Final pay depends on factors such as location, federal contract labor categories and wage rates, relevant experience, skills, education, and certifications.

The range shown is the national average, since the role can be worked in more than one location.

Benefits

• Comprehensive benefits including healthcare, wellness, financial, retirement, family support, continuing education, and time off.
• Flexible time off that lets you take the time you need.
• Learning resources and development opportunities to support your career goals.