Principal Identity Access and Zero Trust Architect - TS/SCI with Polygraph

General Dynamics Information Technology•Chantilly, VA

21h•$161,500 - $218,500•Onsite

About The Position

GDIT is seeking an Enterprise Identity and Access Architect to lead the design and ownership of identity, authentication, authorization, privileged access, and Zero Trust architectures across a major Department of War program. The role balances strong security with a seamless user experience, ensuring identity controls reduce risk without causing repetitive authentication, session disruptions, or operational workarounds. The architect defines enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities. The role also designs authentication flows and integrations between network access policy and identity/device-compliance posture, and develops identity lifecycle controls for users, privileged roles, service accounts, certificates, and automation identities. The position reviews application and platform designs, defines identity logging and monitoring requirements, and partners with cloud, EUC, network, application, and ServiceNow architects. It supports RMF/ATO/cATO documentation, Zero Trust maturity evidence, control implementation, and inspection readiness. The architect leads reviews, resolves policy conflicts, mentors engineers, and briefs Government stakeholders on security and user-experience trade-offs. This is an onsite position in Chantilly, Virginia. It requires an active TS/SCI clearance with polygraph and U.S. citizenship. The schedule is 40 hours per week, with no travel required.

Requirements

Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or a related field, or approved equivalent experience.
Active TS/SCI clearance with polygraph.
U.S. citizenship.
10+ years of identity, security, directory, or enterprise infrastructure experience, including 5+ years in identity/access architecture.
Deep hands-on knowledge of Active Directory and Microsoft Entra ID, including federation/synchronization, Conditional Access, RBAC, PIM, MFA, device identity, and hybrid identity.
Strong understanding of Zero Trust, identity-centric access, least privilege, continuous evaluation, device posture, and policy enforcement.
Experience designing authentication and authorization for enterprise and mission applications using SAML, OAuth 2.0, OpenID Connect, Kerberos, certificates, or comparable mechanisms.
Experience with privileged-access management, identity governance/recertification, service accounts, secrets, PKI, and non-person entities.
Experience with Cisco ISE or a comparable NAC platform and integration between network access and enterprise identity/device posture.
Working knowledge of RMF, NIST controls, STIGs, audit logging, incident response, classified data boundaries, and ATO impacts.
Demonstrated technical leadership, structured decision-making, conflict resolution, mentoring, and ability to explain identity trade-offs to non-specialists.

Nice To Haves

Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert, CISSP, or role-relevant ISSAP, ISSEP, or CCSP.
Experience with M365 GCC/GCC High, Azure Government, AVD, Intune, Defender, and mission-application integration in DoW/IC environments.
Experience implementing single sign-on or session consolidation for high-security applications with measurable reduction in user friction.
Experience integrating identity telemetry with Sentinel, Splunk/Elastic, Dynatrace, ServiceNow, or security analytics.
Prior IC experience and familiarity with cross-domain or multi-enclave identity constraints.

Responsibilities

Define enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities.
Lead authentication-flow analysis and design for single-session mission applications, including token and session behavior, step-up authentication, timeouts, reauthentication, and fallback.
Design integration between Cisco ISE network access policy and Microsoft identity/device-compliance posture, including trust, claims, attributes, policy decision points, and failure behavior.
Develop identity lifecycle controls for onboarding, transfers, termination, recertification, entitlements, privileged roles, service accounts, certificates, and automation identities.
Review application and platform designs for authentication, authorization, secrets, token handling, least privilege, separation of duties, session security, and auditability.
Define identity-related logging, monitoring, anomaly detection, evidence, and incident-response requirements with Security, Observability, and Service Operations.
Partner with cloud, EUC, network, application, and ServiceNow architects to integrate identity decisions across teams.
Support RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness for identity capabilities.
Lead identity architecture reviews, resolve cross-team policy conflicts, mentor engineers, and brief Government stakeholders on risk and user-experience trade-offs.

Benefits

Comprehensive benefits and wellness packages.
401(k) with company match.
Competitive pay and paid time off.
Medical plan options, some with Health Savings Accounts.
Dental plan options.
Vision plan.
Full flex work weeks where possible.
Paid time off plans including vacation, sick and personal time, holidays, paid parental, military, bereavement, and jury duty leave.
Short- and long-term disability benefits.
Life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance are provided or available.
Career growth tools and learning opportunities.
Internal mobility support.