IAM Architect (Remote)

GovCIO is currently hiring an IAM Architect specializing in Identity Resolution and Person Matching to design and lead enterprise capabilities that establish a single, trusted, authoritative identity for every individual across mission and business systems at the Department of Veterans Affairs. This role owns the architecture for matching, deduplicating, and linking person records — combining traditional Identity, Credential, and Access Management (ICAM) engineering with deterministic and probabilistic identity-matching disciplines to reduce duplicate identities, prevent identity fraud, and improve data quality across the enterprise. This is a fully remote position located within the United States.

Please note: The contract has not been awarded;  this position remains unfunded and is contingent upon the award of the contract. 

• Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores. 

• Design deterministic and probabilistic record-linkage strategies — including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching — to accurately resolve person identities across disparate and inconsistently formatted data sources. 

• Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning. 

• Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program. 

• Design and implement Zero Trust identity principles across enterprise network and application boundaries. 

• Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP). 

• Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data. 

• Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders. 

• Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts. 

• Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.    

• Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines. 

Required Skills & Experience 

• Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience).
  • • 12+ years of experience in identity and access management engineering/architecture.

• 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments. 

• Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage. 

• Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture. 

• Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture). 

• One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications. 

Clearance Required: Must be able to obtain and maintain a suitability/public trust clearance.

Preferred Skills & Experience 

• Experience with entity-resolution or Master Person Index (MPI). 

• Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert. 

• Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency). 

• Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls. 

• Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways. 

• Master's degree in a related technical field.