IAM Architect (Remote) - GovCIO

Responsibilities

• Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores.

Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores.

• Design deterministic and probabilistic record-linkage strategies — including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching — to accurately resolve person identities across disparate and inconsistently formatted data sources.

Design deterministic and probabilistic record-linkage strategies — including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching — to accurately resolve person identities across disparate and inconsistently formatted data sources.

• Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.

Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.

• Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.

Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.

• Design and implement Zero Trust identity principles across enterprise network and application boundaries.

Design and implement Zero Trust identity principles across enterprise network and application boundaries.

• Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).

Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).

• Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.

Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.

• Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.

Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.

• Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.

Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.

• Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.  

Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.  

• Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines.

Required Skills & Experience

• Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience). 12+ years of experience in identity and access management engineering/architecture.

Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience).

• 12+ years of experience in identity and access management engineering/architecture.

Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience). 12+ years of experience in identity and access management engineering/architecture.

• 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.

8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.

• Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.

Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.

• Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.

Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.

• Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).

Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).

• One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications.

Preferred Skills & Experience

• Experience with entity-resolution or Master Person Index (MPI).

Experience with entity-resolution or Master Person Index (MPI).

• Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.

Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.

• Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).

Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).

• Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.

Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.

• Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.

Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.

• Master's degree in a related technical field.

If you are selected to move forward through the process, here’s what you can expect:

• During the Interview Process
• Virtual video interview conducted via video with the hiring manager and/or team Camera must be on A valid photo ID must be presented during each interview

During the Interview Process

• Virtual video interview conducted via video with the hiring manager and/or team
• Camera must be on
• A valid photo ID must be presented during each interview

During the Interview Process Virtual video interview conducted via video with the hiring manager and/or team Camera must be on A valid photo ID must be presented during each interview

• During the Hiring Process
• Enhanced Biometrics ID verification screening Background check, to include: Criminal history (past 7 years) Verification of your highest level of education Verification of your employment history (past 7 years), based on information provided in your application

During the Hiring Process

• Enhanced Biometrics ID verification screening
• Background check, to include:
• Criminal history (past 7 years) Verification of your highest level of education Verification of your employment history (past 7 years), based on information provided in your application

Background check, to include:

• Criminal history (past 7 years)
• Verification of your highest level of education
• Verification of your employment history (past 7 years), based on information provided in your application

At GovCIO, we consistently hear that meaningful work and a collaborative team environment are two of the top reasons our employees enjoy working here. In addition, our employees have access to a range of perks and benefits to support their personal and professional well-being, beyond the standard company offered health benefits, including:

• Employee Assistance Program (EAP)
• Corporate Discounts
• Learning & Development platform, to include certification preparation content
• Training, Education and Certification Assistance*
• Referral Bonus Program
• Internal Mobility Program
• Pet Insurance
• Flexible Work Environment