Identity Access Management (IAM) Engineer

RayTek is seeking an Identity Access Management Engineer to build and run the identity fabric at the center of a mission-application modernization program for a Department of War customer: one sign-on, one work surface, and a repeatable pattern for onboarding legacy applications to a shared platform. Every user and every application passes through this layer, so it gates the rest of the platform.

The fabric is a Keycloak broker that holds no local credentials. It federates to the customer's existing identity providers for CAC/PIV and identity-proofed MFA, issues one normalized token, and hands users into each application with short-lived, single-audience tokens. Success means users sign on once and reach every onboarded application with the right access, and the identity controls pass security review on the first submission.

Key responsibilities

Identity broker build and operations

• Design, deploy, and operate Keycloak as a credential-free federation broker in AWS GovCloud on Kubernetes, with high availability, backup, and upgrade paths.
  
• Federate to the customer's OIDC and SAML identity providers, including CAC/PIV (PKI) and non-PKI multi-factor paths.
  
• Build claim mappers and assurance levels that produce one normalized token: user type, roles, organization, and assurance.
  
• Register the platform as a relying party with the customer's identity providers and manage certificates, keys, and secrets rotation.
  

Token exchange and authorization

• Implement OAuth 2.0 Token Exchange (RFC 8693) for short-lived, single-audience tokens so the browser never holds an application's token.
  
• Implement silent sign-on into existing applications without rewriting them.
  
• Work with the Platform Architect on attribute-based, least-privilege authorization with Open Policy Agent: claims, policy inputs, and decision logging.
  

Application onboarding

• Write the identity integration guide and templates that application teams use to join the platform.
  
• Lead identity discovery with application owners: current login method, roles, and the path to the shared broker.
  
• Troubleshoot sign-on and access issues across onboarded applications.
  

Security and evidence

• Write automated tests for role switching, revocation, prohibited actions, and token lifetime, run in the CI pipeline.
  
• Produce the identity portions of the security authorization (RMF) evidence with the security lead.
  
• Present identity design and status at sprint demonstrations and phase-exit reviews.
  

Required qualifications

• Active Secret clearance.
  
• Bachelor's degree in computer science or a related field, or equivalent experience, and 10+ years in software or systems engineering, with 5+ years focused on identity and access management.
  
• Deep hands-on Keycloak experience in production: realms, identity brokering, mappers, authentication flows, clustering, and upgrades.
  
• Strong working knowledge of OIDC, OAuth 2.0, SAML 2.0, and PKI / smart-card (CAC/PIV) authentication.
  
• Experience integrating single sign-on into legacy applications without rewriting them.
  
• Experience running identity services on Kubernetes in a regulated or Government cloud.
  

Desired qualifications

• Experience with DoD identity services (DISA E-ICAM, D-ICAM) or other Federal ICAM programs.
  
• OAuth 2.0 Token Exchange (RFC 8693) in production.
  
• Policy-as-code with Open Policy Agent / Rego.
  
• Zero-trust architecture experience; familiarity with NIST SP 800-63 assurance levels.
  
• Java (Keycloak SPI development) or Go; AWS GovCloud; Helm; OpenTofu or Terraform.
  
• Experience producing RMF authorization evidence for identity controls.
  
• Security+ or CISSP (DoD 8140 baseline).