ICAM Specialist

Celestial Innovations Group•Washington, DC

3d•$135,000 - $155,000•Hybrid

About The Position

Celestial Innovations Group (CIG) is seeking an Identity, Credential, and Access Management (ICAM) Specialist to deliver Enterprise ICAM support services for federal agency clients, with priority focus on PIV-enabled logical access implementation across enterprise systems. The specialist will bring Federal PKI/ICAM experience, including hands-on PIV/PIV-I Smartcard credential issuance and lifecycle management, Intercede MyID CMS Enterprise architecture and deployment, and Microsoft Entra Certificate Based Authentication (CBA). This work supports the Identity pillar of Zero Trust Architecture (ZTA) programs guided by the principle of "never trust, always verify," and aligned with federal mandates including EO 14028, OMB M-22-09, NIST SP 800-207, and the CISA Zero Trust Maturity Model. These responsibilities and strategies are currently shared across three teams and, as a result, are owned by none of them. Current cyber threats require aligning, consolidating, and bridging access control strategies and policies into a unified front, so the organization can maintain a strong security posture ahead of adversaries. Must be located in the DC Metro Area as this role requires onsite and remote support.

Requirements

5+ years of experience in cybersecurity engineering, network security, or IT infrastructure roles
Experience supporting federal government clients or DoD/civilian agency environments
5+ years of Federal PKI and Identity, Credential, and Access Management (ICAM) experience
Federal PKI/ICAM experience, with demonstrated hands-on PIV/PIV-I Smartcard credential issuance and lifecycle management experience
Credential Management System (CMS) experience, including Intercede MyID CMS Enterprise architecture and deployment
Hands-on experience designing, deploying, configuring, and operating Intercede MyID CMS Enterprise, including credential profiles, enrollment workflows, Smartcard issuance, certificate provisioning, renewal, revocation, and integration with PKI and enterprise identity services
Microsoft Entra Certificate Based Authentication (CBA)
Demonstrated understanding of ZTA concepts across all five pillars per NIST SP 800-207 and the CISA Zero Trust Maturity Model
Identity and access management: Entra ID, Active Directory, LDAP, PKI, MFA, and PAM tooling
Endpoint security: device compliance policy enforcement
Cloud environments: Azure, AWS, or hybrid cloud architectures
Familiarity with SIEM/SOAR platforms (Microsoft Sentinel, SumoLogic, Google SecOps, or equivalent)

Nice To Haves

Proficiency in at least one of the following: Palo Alto Prisma, or Microsoft Zero Trust stack
Certifications: CISSP, CISM, CompTIA Security+, Cloud+, or relevant AWS/Azure security certifications
Zero Trust vendor certifications: PCCSE, PCNSE, Microsoft SC-100 (Cybersecurity Architect Expert)
Familiarity with RMF processes: NIST SP 800-37, SSP authoring, ATO package preparation
Experience with ServiceNow, Salesforce, or IT service management tooling in a federal context

Responsibilities

Deliver Enterprise Identity, Credential, and Access Management (ICAM) support services, with priority focus on PIV-enabled logical access implementation across enterprise systems
Perform PIV/PIV-I Smartcard credential issuance and lifecycle management
Design, deploy, configure, and operate Intercede MyID CMS Enterprise, including credential profiles, enrollment workflows, Smartcard issuance, certificate provisioning, renewal, and revocation
Integrate Intercede MyID CMS Enterprise with PKI and enterprise identity services
Implement and support Microsoft Entra Certificate Based Authentication (CBA)
Implement Identity and Access Management controls including CAC/PIV authentication, MFA, role-based access control (RBAC), and Just-in-Time (JIT) Privileged Access Management
Own top-level Conditional Access policy design and privileged access governance in Microsoft Entra ID/M365
Own access policy exception management, including governance workflows and audit-ready evidence documentation
Support Zero Trust Architecture assessments, gap analyses, and roadmap development for federal clients, with emphasis on the Identity pillar
Translate federal ZTA mandates (EO 14028, OMB M-22-09, CISA ZT Maturity Model) into actionable implementation plans
Enforce device posture as a condition of access decisions, integrating SCCM, Intune, Workspace ONE (WS1), Purview, Qualys, and Palo Alto NGFW signals
Define and enforce application-layer access policy and decisions across M365, Palo Alto NGFW, Entra ID, and Workspace ONE (WS1)
Align implementations with NIST SP 800-53 Rev 5, NIST SP 800-207, DISA STIGs, and continuous diagnostics and mitigation program requirements
Support the Risk Management Framework (RMF) lifecycle, including SSP authoring, continuous monitoring, and ATO maintenance
Document controls for system security packages, POA&Ms, and security assessment reports
Serve as a trusted ICAM and ZTA advisor to federal agency stakeholders, program managers, and ISSO/ISSM counterparts
Produce executive-level briefings, technical white papers, and implementation status reports
Collaborate cross-functionally with cloud, networking, data analytics, and infrastructure teams