Systems Engineer

Position Description

Seeking an experienced identity engineer for a position as part of the team supporting the Laboratory identity and access management platform.  Blending a strong technical background in identity concepts and technologies with leadership qualities, this individual will help oversee a robust IAM landscape that is responsible for identity management, PKI, privileged access management, single sign-on and identity governance administration.  The successful candidate for this position will have experience in architecting, deploying and administering various IAM solutions outlined above and displays skill in building relationships, managing time and tasks effectively and has solid communications skills in both writing and presenting.  This position will work closely with other Laboratory technical teams and have a blend of both security and usability perspectives.  A hybrid work arrangement, this candidate will be required to be on-site in an as-needed capacity and participate in an on-call rotation with off-hour support on occasion.  This position reports to the enterprise platforms and infrastructure group within the Laboratory’s digital solutions department. 

Primary Duties

• Architecture and Administration of the Laboratories Public Key Infrastructure consisting of both cloud and on premise components including certificate authorities / templates, certificate revocation services and hardware security modules. 
• Lead engineer for multi-factor authentication and token management currently consisting of an assortment of tokens supporting certificate-based authentication for Windows, Macintosh, Linux and iOS. 
• Certificate administration and management for end-point platform configuration and adoption of authentication supporting OS, VPN and Single Sign-On. 
• Participation in the administration and design of identity management solutions including directories, account creation and updates and integration with an assortment of platforms facilitating access and systems management. 
• Help create and maintain artifacts in support of the IAM landscape including technical, administrative and support knowledge, product roadmaps, strategic guidance, vendor management and operational procedures. 
• Ensure systems compliance with Laboratory security policies and practices and ensure system availability and adoption by customers. 
• Participate in IT service management for the IAM systems including incident, knowledge and problem management as well as fulfilling service requests as necessary. 

Minimum Qualifications

• Bachelors Degree and/or 5-10 years of experience
• Strong working knowledge and experience with PKI services and operations including management of certificate templates, support and operation of PKI components and troubleshooting of certificate issues involving authentication, code signing and S/MIME operations. 
• Experience with designing, deploying and supporting multi-factor authentication solutions and tokens including YubiKey, Smartcard (including DoD Common Access Card), Passkeys and Biometrics across various operating systems including Windows, Macintosh, Linux and Apple iOS. 
• Familiarity with PKI systems based on Microsoft Certificate Services. 
• Experience with identity management systems including design / support and administration practices.  Ability to troubleshoot LDAP and Active Directory objects, attributes and permissions for variety of accounts including user, administrative, service and machine objects. 
• Ability to utilize AI services in helping to troubleshoot, configure and deploy solutions.  Familiarity with automation and orchestration principles for operational efficiency and scripting experience with Microsoft PowerShell, Python or Bash. 
• Solid foundation with networking and infrastructure fundamentals including troubleshooting best practices with firewall and micro segmentation integration including ports and protocols, load balancing and name resolution. 
• Understanding and hands-on experience with engineering best practices and principles including security design and best practices, systems management and monitoring, log file analysis, ensuring continuity of operations and development guidelines and practices. 
• Proven leadership capabilities including accountability, demand management, effective delegation, time management, vendor management, and proven communication skills. 

Preferred Qualifications

• Working knowledge of Identity Management platforms including NetIQ/OpenText, Microsoft EntraID and Microsoft Active Directory. 
• Understanding of Single Sign-On protocols and principles include SAML 
• Experience with cloud-based architecture and systems management for hosting identity solutions including hybrid configurations with on premise IdM components. 
• Understanding of security configuration guidelines and compliance involving NIST 800-171 to include security baselines, implementation and documentation.  Experience with security audits is also a plus. 
• Security certifications (e.g. CISSP, Security+) and foundational understanding of Splunk logging. 

Other Qualifications

• Ability to obtain and maintain a security clearance is required for this position. 
• Participation in on-call rotation and occasional off-hour support is required.