Active Directory/IAM Engineer

Saxon Global • Manassas, VA

4d

About The Position

The Active Directory/IAM Engineer will apply deep identity and access management and security engineering expertise across workforce and customer-facing identity environments. The role requires protocol-level knowledge of OAuth 2.0 and OpenID Connect, including grant types, token types and intended uses, token validation, and common implementation mistakes. It also involves hands-on experience engineering phishing-resistant authentication using FIDO2/WebAuthn, passkeys, or hardware security keys, and communicating why these methods resist phishing.

The engineer should understand how workforce IAM and customer-facing identity differ in goals, risks, and design priorities. The position also calls for working knowledge of SAML 2.0 and federation, experience with a major identity platform, and scripting or development skills for automation and integration. The engineer must be able to explain identity concepts clearly to engineers, auditors, and business stakeholders.

Requirements

• 10+ years in identity and access management, security engineering, or a closely related role, including at least 3 years of hands-on IAM experience.
• Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect, including grant types, token types and their intended uses, token validation, and common implementation mistakes.
• Hands-on experience deploying or engineering phishing-resistant authentication with FIDO2/WebAuthn, passkeys, or hardware security keys, and ability to explain why these methods resist phishing.
• Experience with both workforce IAM and customer-facing identity, and a clear understanding of how their goals, risks, and design priorities differ.
• Working knowledge of SAML 2.0 and federation.
• Hands-on experience with at least one major identity platform, such as Microsoft Entra ID, Okta, Ping Identity, or Auth0.
• Scripting or development skills, for example Python, PowerShell, JavaScript, or C#, for automation and integration work.
• Ability to explain technical identity concepts clearly to engineers, auditors, and business stakeholders.

Nice To Haves

• Experience with dedicated CIAM platforms, such as Auth0, Okta Customer Identity, Microsoft Entra External ID, Ping, or ForgeRock.
• Familiarity with newer OAuth security practices, such as PKCE, token binding approaches (DPoP or mTLS), and the OAuth 2.0 Security Best Current Practice.
• Experience with identity governance and administration (IGA) and privileged access management (PAM) tools, such as SailPoint, Saviynt, or CyberArk.
• Experience with SCIM provisioning and API gateway authorization.
• Experience in a regulated industry, such as financial services, healthcare, or legal.
• Relevant certifications, such as CISSP, Microsoft SC-300, Okta Certified Professional or Consultant, or a CIAM vendor certification.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed