ClouId Identity & Access Management - SOCEUR

Job Title: ClouId Identity & Access Management - SOCEUR Job Category: Information Technology Time Type: Full time Minimum Clearance Required to Start: TS/SCI Employee Type: Regular Percentage of Travel Required: Up to 10% Type of Travel: Local \* \* \* **The Opportunity:** As a CACI Cloud Identity & Access Management (IAM) Engineer to architect, build, and maintain the highly available authorization infrastructure for the Special Operations Command Europe (SOCEUR) Hybrid Threat Action Platform (HTAP) ecosystem on Google Cloud Platform (GCP). This role sits inside the HTAP program team and is responsible for designing the core identity federation, access policies, and security boundaries that protect mission-critical data. The individual will architect distributed authorization systems, broker identities between unclassified and classified environments, and implement a zero-trust security model. The individual will interact regularly with cybersecurity architects, application developers, and platform engineers to ensure secure, auditable, and least-privilege access across all systems. **Responsibilities:** - Architect and scale large-scale, distributed cloud-native authorization services on GCP to support massive query loads and enforce granular access control. - Lead the design and implementation of identity federation between on-premises/external identity providers and Google Cloud Identity, using protocols like SAML and OIDC. - Integrate and manage identity platforms such as Keycloak with Google Workspace to implement strict Role-Based Access Control (RBAC) and Multi-Factor Authentication (MFA), including CAC/PIV integration. - Design, manage, and audit IAM policies, roles, and bindings as code using Terraform to ensure an automated, repeatable, and secure identity lifecycle. - Engineer and enforce access control strategies for multi-level security environments, managing identity and access across different security domains (e.g., Unclassified to Secret). - Develop and implement context-aware access policies and zero-trust principles to protect sensitive data and APIs. - Conduct regular security assessments and audits of IAM policies, access permissions, and service account usage to identify and remediate risks. - Collaborate with the security operations team to provide IAM-specific context during incident response and threat analysis. - **Qualifications:** **Required:** - Must be a US Citizen possessing an active TS/SCI security clearance. - Bachelor's degree in Computer Science, Cybersecurity, or a related field (or equivalent practical experience). - 5+ years of experience in backend software engineering or security engineering, with at least 3+ years specifically focused on designing and implementing Identity and Access Management (IAM) systems on a major cloud platform (GCP preferred). - Deep expertise in identity federation protocols (SAML, OAuth, OIDC) and experience integrating with identity providers (e.g., Keycloak, Azure AD, Okta). - Hands-on experience with Google Cloud IAM, Google Cloud Identity, and Google Workspace, including service accounts, workload identity, and organization policies. - Experience with Infrastructure as Code (IaC), specifically using Terraform to manage IAM resources. - Strong proficiency in a language like Python, Go, or C++ for building scalable backend systems. - Experience with Public Key Infrastructure (PKI) and integrating smart card authentication (CAC/PIV). - Google Cloud Professional Cloud Security Engineer certification. - One of the following advanced security or identity certifications: CISSP, CCSP, or Certified Identity and Access Manager (CIAM). **Desired:** - Google Workspace Professional Collaboration Engineer certification. - • Experience using AI-assisted tools for secure software development and debugging. - • Experience working in a high-availability, low-latency distributed services environment. - **What You Can Expect:** **A culture of integrity.** At CACI, we place…