Type of Requisition:

Regular

Clearance Level Must Currently Possess:

Secret

Clearance Level Must Be Able to Obtain:

Secret

Public Trust/Other Required:

None

Job Family:

IT Infrastructure and Operations

Job Qualifications:

Skills:

Microsoft Azure, Microsoft Cloud, Secure Authentication, Single Sign-On (SSO)

Certifications:

None

Experience:

15 + years of related experience

US Citizenship Required:

Yes

Job Description:

ICAM Identity Provider (IdP) Engineer – Enterprise Authentication Services

GDIT is seeking a highly experienced Principal ICAM Architect and Identity Provider Engineer to lead enterprise-scale authentication and federation strategy across the Department of Defense. This role serves as a senior technical authority responsible for defining architecture, guiding engineering teams, and delivering resilient Identity Provider (IdP) services that support secure authentication for more than 4 million DoD enterprise identities.

This position is fully remote.

MEANINGFUL WORK AND PERSONAL IMPACT

The ideal candidate brings 15+ years of deep experience in identity architecture, enterprise authentication platforms, federation engineering, and strategic ICAM modernization. As a Principal Engineer, you will define enterprise standards, drive Zero Trust–aligned identity strategies, and provide authoritative guidance across mission-critical authentication ecosystems. You will serve as a senior technical leader partnering with cybersecurity, infrastructure, and application teams to evolve enterprise identity capabilities.

• Serve as the enterprise technical lead and architect for Identity Provider services across DoD, driving long-term ICAM strategy, modernization, and architectural governance.
• Architect, build, and evolve large-scale ADFS and modern IdP platforms to deliver secure, resilient authentication and federation for millions of identities.
• Define enterprise trust architectures, federation models, and cross-boundary identity integration patterns with internal DoD components, mission partners, and external organizations.
• Lead design and architecture of authentication solutions leveraging SAML, OAuth, OpenID Connect (OIDC), WS-Federation, JWT, and certificate-based technologies.
• Set technical direction for onboarding applications, APIs, and enterprise services into the authentication ecosystem, ensuring alignment with Zero Trust and DoD ICAM standards.
• Develop enterprise-wide policies, claims rule frameworks, token issuance patterns, identity assurance levels, and authorization logic.
• Provide principal-level oversight for MFA, phishing-resistant authentication, Conditional Access, and passwordless identity technologies.
• Act as the senior escalation point for the most complex trust, certificate, federation, and token issues impacting mission-critical workloads.
• Architect highly available, fault-tolerant authentication platforms incorporating advanced load balancing, multi-region resiliency, failover, and operational continuity strategies.
• Produce authoritative technical documentation including architecture roadmaps, engineering standards, reference architectures, integration guides, and operational frameworks.
• Lead and mentor engineering teams, provide guidance during Agile development cycles, and champion continuous improvement across authentication services.
• Identify enterprise risks, drive mitigation strategies, and advise senior leadership on authentication posture, ICAM modernization plans, and Zero Trust progress.

Basic Qualifications:

Active Secret Clearance at minimum. Interim Secret Clearances are not allowed.
Bachelor’s Degree in a related technical discipline, or the equivalent combination of education, technical certifications or training, or work experience.
DoD 8570/8140 IAT Level II certification (Security+ CE or higher)

Required Skills/Knowledge:

15+ years of experience in enterprise identity architecture, ICAM engineering, authentication platforms, or federation technologies.
Deep expertise designing and leading enterprise-scale ADFS and IdP solutions.
Proven leadership architecting identity systems for large regulated environments supporting millions of users.
Advanced understanding of authentication, authorization, identity assurance, federation protocols, and Zero Trust identity pillars.
Strong experience with SAML, OAuth, OIDC, WS-Federation, JWT, PKI, smart card authentication, and MFA architectures.
Architecture-level experience integrating mission applications and APIs with enterprise IdP and federation platforms.
Expert-level proficiency with Active Directory, LDAP directories, identity repositories, and claims-based identity systems.
Hands-on experience designing enterprise token rules, claims mappings, federation workflows, and trust policies.
Expertise with Windows and Linux server platforms in identity contexts.
Experience deploying identity COTS products in secure environments.
Excellent communication skills, with ability to provide guidance to engineers and influence leadership.
Proven success driving large-scale identity initiatives from architecture to implementation.

Desired Skills/Knowledge:

Experience designing and supporting highly available ADFS farms with Web Application Proxy (WAP), load balancing, and disaster recovery architectures.
Experience with Microsoft Entra ID (Azure AD), PingFederate, PingAccess, PingDirectory, Okta, Keycloak, or similar enterprise authentication platforms.
Experience supporting DoD Enterprise ICAM, Federation Hub, or mission partner federation initiatives
Experience implementing federation solutions for coalition, partner, or cross-organizational environments
Experience supporting NIST 800-63 Identity Assurance Levels (IAL), Authenticator Assurance Levels (AAL), and Federation Assurance Levels (FAL)
Experience implementing phishing-resistant authentication technologies and passwordless authentication solutions.
Experience supporting Zero Trust Architecture and identity-centric security initiatives.
Familiarity with PowerShell scripting and automation for ADFS administration.
Experience supporting enterprise monitoring, performance tuning, and capacity planning for authentication services supporting millions of identities.
Experience with Active Directory Certificate Services (AD CS) and enterprise PKI.
Familiarity with container technologies such as Docker and Kubernetes.
Familiarity with DoD PKI, CAC authentication, derived credentials, and certificate lifecycle management.
Experience supporting highly available, mission-critical enterprise authentication environments.

GDIT IS YOUR PLACE
At GDIT, the mission is our purpose, and our people are at the center of everything we do.
● Growth: AI-powered career tool that identifies career steps and learning opportunities
● Support: An internal mobility team focused on helping you achieve your career goals
● Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off
● Flexibility: Full-flex work week to own your priorities at work and at home
● Community: Award-winning culture of innovation and a military-friendly workplace

The likely salary range for this position is $255,000 - $345,000. This is not, however, a guarantee of compensation or salary. Rather, salary will be set based on experience, geographic location and possibly contractual requirements and could fall outside of this range.

Scheduled Weekly Hours:

Travel Required:

Less than 10%

Telecommuting Options:

Remote

Work Location:

USA VA Falls Church

Additional Work Locations:

Any Location / Remote

Total Rewards at GDIT:

Our benefits package for all US-based employees includes a variety of medical plan options, some with Health Savings Accounts, dental plan options, a vision plan, and a 401(k) plan offering the ability to contribute both pre and post-tax dollars up to the IRS annual limits and receive a company match. To encourage work/life balance, GDIT offers employees full flex work weeks where possible and a variety of paid time off plans, including vacation, sick and personal time, holidays, paid parental, military, bereavement and jury duty leave. GDIT typically provides new employees with 15 days of paid leave per calendar year to be used for vacations, personal business, and illness and an additional 10 paid holidays per year. Paid leave and paid holidays are prorated based on the employee’s date of hire. The GDIT Paid Family Leave program provides a total of up to 160 hours of paid leave in a rolling 12 month period for eligible employees. To ensure our employees are able to protect their income, other offerings such as short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness and business travel and accident insurance are provided or available. We regularly review our Total Rewards package to ensure our offerings are competitive and reflect what our employees have told us they value most.

Our Identity Verification Process:

As part of the hiring process, we will ask you to complete an identity verification process that leverages advanced biometrics and artificial intelligence to ensure authenticity and protect against identity fraud. You are expected to be on camera during virtual interviews. We reserve the right to take your picture to verify your identity and prevent fraud. By proceeding, you authorize the collection, processing, and use of your biometric data for identity verification and security purposes.

About Our Work:

We are GDIT. A global technology and professional services company that delivers technology solutions and mission services to every major agency across the U.S. government, defense and intelligence community. Our 26,000 experts extract the power of technology to create immediate value and deliver solutions at the edge of innovation. We operate across 50+ countries worldwide, offering leading mission-ready capabilities in AI, cloud, cyber and software development.

Join our Talent Community to stay up to date on our career opportunities and events at

gdit.com/tc.

Equal Opportunity Employer / Individuals with Disabilities / Protected Veterans

Learn more about this Employer on their Career Site