Systems Engineer

MIT Lincoln Laboratory•Lexington, MA

19d•$114,600 - $151,900•Hybrid

About The Position

MIT Lincoln Laboratory is seeking an experienced identity engineer to support its identity and access management (IAM) platform. The role combines technical expertise in identity concepts and technologies with leadership, helping oversee an IAM environment that includes identity management, PKI, privileged access management, single sign-on, and identity governance administration. The successful candidate will have experience architecting, deploying, and administering IAM solutions, and will bring strong relationship-building, time and task management, and written and presentation communication skills. The position works closely with other Laboratory technical teams and balances security and usability considerations. This is a hybrid role requiring on-site work as needed and participation in an on-call rotation, including occasional off-hour support. It reports to the enterprise platforms and infrastructure group within the Laboratory’s digital solutions department. The selected candidate must be able to obtain and maintain a Secret-level DoD security clearance and will undergo a pre-employment background investigation. U.S. citizenship is required.

Requirements

Bachelor’s degree and/or 5–10 years of experience.
Strong working knowledge and experience with PKI services and operations, including certificate template management, PKI component support and operation, and troubleshooting certificate issues involving authentication, code signing, and S/MIME.
Experience designing, deploying, and supporting multi-factor authentication solutions and tokens, including YubiKey, smartcards (including DoD Common Access Card), passkeys, and biometrics across Windows, Macintosh, Linux, and Apple iOS.
Ability to obtain and maintain a security clearance; the selected candidate must be able to obtain and maintain a Secret-level DoD security clearance.
Familiarity with PKI systems based on Microsoft Certificate Services.
Experience with identity management systems, including design, support, and administration practices.
Ability to troubleshoot LDAP and Active Directory objects, attributes, and permissions for user, administrative, service, and machine accounts.
Ability to use AI services to help troubleshoot, configure, and deploy solutions.
Familiarity with automation and orchestration principles and scripting experience with Microsoft PowerShell, Python, or Bash.
Solid foundation in networking and infrastructure fundamentals, including firewall and micro-segmentation integration, ports and protocols, load balancing, and name resolution troubleshooting.
Hands-on understanding of engineering best practices, including security design, systems management and monitoring, log file analysis, continuity of operations, and development guidelines and practices.
Proven leadership capabilities, including accountability, demand management, effective delegation, time management, and vendor management, along with proven communication skills.
Participation in an on-call rotation and occasional off-hour support is required.
U.S. citizenship is required.

Nice To Haves

Working knowledge of identity management platforms including NetIQ/OpenText, Microsoft Entra ID, and Microsoft Active Directory.
Understanding of single sign-on protocols and principles, including SAML.
Experience with cloud-based architecture and systems management for hosting identity solutions, including hybrid configurations with on-premises identity management components.
Understanding of security configuration guidelines and compliance involving NIST 800-171, including security baselines, implementation, and documentation; experience with security audits is a plus.
Security certifications such as CISSP or Security+ and foundational understanding of Splunk logging.

Responsibilities

Architect and administer the Laboratory’s public key infrastructure, including cloud and on-premises components such as certificate authorities and templates, certificate revocation services, and hardware security modules.
Serve as lead engineer for multi-factor authentication and token management, supporting tokens for certificate-based authentication across Windows, Macintosh, Linux, and iOS.
Administer and manage certificates for endpoint platform configuration and adoption of authentication supporting operating systems, VPN, and single sign-on.
Participate in the administration and design of identity management solutions, including directories, account creation and updates, and integrations with platforms supporting access and systems management.
Create and maintain technical, administrative, and support artifacts for the IAM environment, including product roadmaps, strategic guidance, vendor management, and operational procedures.
Ensure systems comply with Laboratory security policies and practices, and support system availability and customer adoption.
Participate in IT service management for IAM systems, including incident, knowledge, and problem management, and fulfill service requests as needed.
Participate in an on-call rotation and provide occasional off-hour support.