Principal Identity Access and Zero Trust Architect - TS/SCI with Polygraph

GD Information Technology • Chantilly, VA

1d • $161,500 - $218,500 • Onsite

About The Position

GDIT is seeking an Enterprise Identity and Access Architect to lead the design and ownership of identity, authentication, authorization, privileged access, and Zero Trust architectures across a major Department of War program. The role balances robust security with a seamless user experience, ensuring identity controls reduce risk without creating repetitive authentication, session disruptions, or operational workarounds. It is an onsite position in Chantilly, Virginia, requiring active TS/SCI clearance with polygraph and U.S. citizenship. The schedule is 40 hours per week, with no travel required.

The architect defines enterprise identity principles, target architecture, patterns, decision records, and exception criteria across directory, cloud identity, PKI, federation, MFA, access controls, privileged access, and service identities. The role leads authentication-flow design for mission applications, integrates network access policy with Microsoft identity and device-compliance posture, and develops identity lifecycle controls. It also reviews application and platform designs, establishes identity logging and incident-response requirements, and coordinates with cloud, end-user computing, network, application, and ServiceNow architects.

The position supports RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness. It includes leading architecture reviews, resolving cross-team policy conflicts, mentoring engineers, and briefing Government stakeholders on security and user-experience trade-offs. Candidates need 10 or more years of related experience, including at least five years in identity/access architecture, and a bachelor’s degree in a related field or approved equivalent experience.

The likely salary range is $161,500–$218,500; actual pay may vary based on experience, geographic location, and contractual requirements. GDIT describes its rewards as including medical, dental, vision, 401(k) with company match, paid time off, wellness offerings, and other insurance and leave benefits.

Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field, or approved equivalent experience.
• Active TS/SCI clearance with polygraph.
• U.S. citizenship required.
• 10 or more years of identity, security, directory, or enterprise infrastructure experience, including at least five years in identity/access architecture.
• Deep hands-on knowledge of Active Directory and Microsoft Entra ID, including federation/synchronization, Conditional Access, RBAC, PIM, MFA, device identity, and hybrid identity.
• Strong understanding of Zero Trust, identity-centric access, least privilege, continuous evaluation, device posture, and policy enforcement.
• Experience designing authentication and authorization for enterprise and mission applications using SAML, OAuth 2.0, OpenID Connect, Kerberos, certificates, or comparable mechanisms.
• Experience with privileged-access management, identity governance/recertification, service accounts, secrets, PKI, and non-person entities.
• Experience with Cisco ISE or a comparable NAC platform and integration between network access and enterprise identity/device posture.
• Working knowledge of RMF, NIST controls, STIGs, audit logging, incident response, classified data boundaries, and ATO impacts.
• Demonstrated technical leadership, structured decision-making, conflict resolution, mentoring, and ability to explain identity trade-offs to non-specialists.

Nice To Haves

• Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert, CISSP, or role-relevant ISSAP, ISSEP, or CCSP certification.
• Experience with M365 GCC/GCC High, Azure Government, AVD, Intune, Defender, and mission-application integration in DoW/IC environments.
• Experience implementing single sign-on or session consolidation for high-security applications with measurable reduction in user friction.
• Experience integrating identity telemetry with Sentinel, Splunk/Elastic, Dynatrace, ServiceNow, or security analytics.
• Prior IC experience and familiarity with cross-domain or multi-enclave identity constraints.

Responsibilities

• Define enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities.
• Lead authentication-flow analysis and design for single-session mission applications, including token and session behavior, step-up authentication, timeouts, reauthentication, and fallback.
• Design integration between Cisco ISE network access policy and Microsoft identity/device-compliance posture, including trust, claims, attributes, policy decision points, and failure behavior.
• Develop identity lifecycle controls for onboarding, transfers, termination, recertification, entitlements, privileged roles, service accounts, certificates, and automation identities.
• Review application and platform designs for authentication, authorization, secrets, token handling, least privilege, separation of duties, session security, and auditability.
• Define identity-related logging, monitoring, anomaly detection, evidence, and incident-response requirements with Security, Observability, and Service Operations.
• Partner with cloud, EUC, network, application, and ServiceNow architects to integrate identity decisions across systems.
• Support RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness for identity capabilities.
• Lead identity architecture reviews, resolve cross-team policy conflicts, mentor engineers, and brief Government stakeholders on risk and user-experience trade-offs.

Benefits

• Comprehensive benefits and wellness packages.
• 401(k) plan with company match.
• Competitive pay.
• Paid time off, including vacation, sick and personal time, holidays, paid parental, military, bereavement, and jury duty leave.
• Medical plan options, some with Health Savings Accounts.
• Dental plan options and a vision plan.
• Short- and long-term disability benefits.
• Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance.
• Full flex work weeks where possible.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal