This role pays less than
92%
of similar roles. Most pay
$147,025–$208,800
— the shaded band above.
At the midpoint, this role pays about
$122k
versus about
$178k
for comparable roles.
Based on 240 similar postings.
Employer
About Leidos
Leidos is an industry and technology leader serving government and commercial customers with smarter, more efficient digital and mission innovations.
Leidos currently has
251 open roles
on FindRole.
Listed pay typically runs
$92,300–$166,850
across 235 roles with salary data.
ICAM Security Engineer
The ICAM Security Engineer joins the Air Traffic Business Area to support the development of the mission-critical L-CAP platform, which provides next-generation air traffic management capabilities via a hybrid cloud data mesh architecture. In this role, you will build and manage the identity, credential, and access management layer governing all user and service interactions. Key responsibilities include integrating government-provided ICAM services using OAuth 2.0 and OpenID Connect, implementing RBAC and ABAC controls, managing certificate lifecycles through mTLS, and ensuring per-session authorization across distributed services. You will utilize technologies such as Keycloak, Kubernetes, and various programming languages including Java, Python, or Go. The work involves solving complex security challenges in a regulated aviation environment by enforcing Zero Trust principles, maintaining audit logs, and leveraging AI-assisted development to enhance software quality and delivery within an Agile framework.
Integrate L-CAP services with government ICAM systems using OAuth 2.0 and OpenID Connect protocols.
Manage identity federation, user stores, and role-based test account provisioning.
Implement per-session authentication and authorization for both user-to-service and service-to-service requests.
Manage certificate lifecycles, including mutual TLS (mTLS), service mesh workload identities, and rotation monitoring.
Design and implement RBAC and ABAC access controls aligned to specific operational roles.
Develop audit logging systems to capture, store, and retrieve authentication and authorization events.
Secure external-facing endpoints by implementing API gateway authorization policies.
Produce ICAM control evidence and resolve identity integration issues across distributed services.
What we're looking for
Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field (additional experience/training may be considered in lieu of degree).
4+ years of relevant experience.
Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping.
Experience with enterprise identity providers such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent.
Working knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS), and/or service mesh identity.
Proficiency in Java, Python, Go, or a comparable programming/scripting language.
U.S. citizenship required with the ability to obtain a Public Trust and meet continuous U.S. residency requirements for FAA access.
Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II certification (preferred); Federal ICAM/FICAM experience (preferred).
Remote (Falls Church, VA)51 days ago
$170,000–$230,000
Active Directory
AD FS
Microsoft Azure
SAML 2.0
OAuth 2.0
OpenID Connect
WS-Federation
MFA
SSO
PKI
LDAP
PowerShell
Docker
Kubernetes
Zero Trust Architecture
Agile
Linux
Windows Server
Remote (Falls Church, VA)51 days ago
$170,000–$230,000
Active Directory
AD FS
Microsoft Azure
SAML 2.0
OAuth 2.0
OpenID Connect
WS-Federation
MFA
SSO
PKI
LDAP
Windows Server
Linux
PowerShell
Docker
Kubernetes
Zero Trust Architecture
Agile