Senior Identity Security Engineer (Arlington, VA or San Diego, CA)

CoStar Group • Arlington, VA

77d • $133,000 - $203,000 • Hybrid

About The Position

CoStar Group is seeking a Senior Identity Security Engineer to enhance security controls for 8000 employees, enabling secure and seamless access to company resources through a zero-trust, FIDO2-compliant framework. This role involves assessing, identifying, and mitigating risks within a large technical infrastructure and corporate environment. The engineer will collaborate with Security, Systems, DevOps, Network, and Development teams to shape access management for employees and engineers. The ideal candidate will possess hands-on experience with modern IAM tools, a deep understanding of adversary tactics (e.g., adversary in the middle attacks, social engineering, privilege escalation), and experience implementing controls to prevent these attacks.

Requirements

• Bachelor’s Degree required from an accredited, not for profit, in person, university or college.
• A track record of commitment to prior employers.
• Thorough understanding of AitM attacks, Evilgnx and understanding on how to neutralize them through strong identity security hygiene.
• 4+ years of hands-on security engineering experience, including implementation of new controls to address threats.
• Strong analytical and problem-solving skills with a data-driven approach to decision-making.
• Hands-on experience administrating industry-standard IDPs (Okta, PingID, Microsoft Entra ID, Active Directory).
• Knowledge of authentication and authorization protocols such as SAML, OAuth, OIDC, Kerberos.
• Firm understanding of PKI, the FIDO2 framework, passkeys, Windows Hello for Business, and Platform SSO, Okta FastPass, Okta Device Trust.
• Solid understanding of role-based access control, least privilege, just-in-time access, and other identity security paradigms.
• Experience analyzing SIEM logs and creating related dashboards.
• Ability to read and author basic scripts in at least one common language (Python, PowerShell, Bash).

Nice To Haves

• Hands-on experience with Microsoft Intune, Jamf, JumpCloud, or other MDM platforms.
• Experience with identity security testing tools such as Bloodhound, AzureHound, SharpHound, Responder, etc.
• Record of automating operational tasks.
• Familiarity with CI/CD infrastructure.
• Experience configuring risk-based conditional access or authentication policies.
• Experience with workload identity governance.
• Strong written and verbal communications skills, with a demonstrated ability to communicate complex topics with both engineering peers and non-technical audiences.
• Experience with AI/ML-assisted security tooling, including building or deploying LLM-based agents.

Responsibilities

• Design, implement, and continuously improve identity security controls across various platforms.
• Develop and maintain conditional access policies for authentication strength, device compliance, privileged roles, sensitive applications, and workload identities.
• Analyze logs to scope and guide rollouts of new security initiatives.
• Support an organization-wide, multi-platform phish-resistant authentication rollout.
• Engineer controls around AI and workload identities (service principals, managed identities, OAuth app registrations).
• Research, prototype, and operationalize AI-assisted tooling and agentic workflows to improve team efficiency, including automating repetitive analysis and building internal tools that surface identity risk.
• Document projects, standards, and runbooks.
• Communicate frequently and effectively with both technical and non-technical stakeholders.
• Participate in attack path management efforts via commercial and open-source tools.
• Stay current with the identity threat landscape and identity defense offerings from major IDP vendors.

Benefits

• Generous compensation and performance-based incentives.
• Internal training.
• Tuition reimbursement.
• Comprehensive healthcare coverage: Medical / Vision / Dental / Prescription Drug.
• Life, legal, and supplementary insurance.
• Virtual and in person mental health counseling services for individuals and family.
• Commuter and parking benefits.
• 401(K) retirement plan with matching contributions.
• Employee stock purchase plan.
• Paid time off.
• On-site fitness center and/or reimbursed fitness center membership costs (location dependent).
• Access to CoStar Group’s Employee Resource Groups.
• Complimentary gourmet coffee, tea, hot chocolate, fresh fruit, and other healthy snacks.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior