below marketmost similar roles pay hereabove market
This role pays less than
58%
of similar roles. Most pay
$154,450–$216,000
— the blue band above.
At the midpoint, this role pays about
$168k
versus about
$185k
for comparable roles.
Based on 240 similar postings.
Employer
About CoStar Group
CoStar Group is the leading provider of commercial real estate information, analytics, and online marketplaces, including CoStar, Apartments.com, and LoopNet platforms. Industry: Commercial Real Estate Data & Analytics
CoStar Group currently has
59 open roles
on FindRole.
Listed pay typically runs
$133,000–$190,000
across 59 roles with salary data.
The Senior Identity Security Engineer joins the security team to harden controls and secure company resources through a zero trust, FIDO2 compliant framework. This role involves assessing and mitigating risks across a large technical infrastructure by identifying and eliminating identity attack paths. You will design and implement identity security controls, harden Tier 0 infrastructure including domain controllers and AD CS, and develop conditional access policies. Key responsibilities include managing workload identities, analyzing logs, and driving attack path management. You will utilize technologies such as Active Directory, Entra ID, Okta, Microsoft Defender for Identity, BloodHound, and Maester. Required skills include knowledge of SAML, OAuth, OIDC, Kerberos, and PKI, alongside proficiency in Python, PowerShell, or Bash to automate tasks and detect threats like Kerberoasting and token theft.
Design and implement identity security controls across various platforms to harden Tier 0 infrastructure.
Develop and maintain conditional access policies for privileged roles, sensitive applications, and workload identities.
Drive attack path management across Active Directory and Entra ID using tools like BloodHound and AzureHound.
Engineer and tune identity threat detections across Microsoft Defender for Identity, Entra ID Protection, and Okta.
Support an organization-wide rollout of multi-platform phish-resistant authentication.
Engineer security controls for AI and workload identities including service principals and managed identities.
Research and operationalize AI-assisted tooling and agentic workflows to automate repetitive security analysis.
Validate identity configurations and catch drift using automated security testing tools.
What we're looking for
Bachelor’s Degree from an accredited, not-for-profit, in-person university or college.
4+ years of hands-on security engineering experience, including implementation of new controls to address threats.
Hands-on experience securing and hardening industry-standard IDPs including Okta, PingID, Microsoft Entra ID, and Active Directory.
Thorough understanding of AitM attacks, token theft, and neutralizing them through phish-resistant authentication and strong identity security hygiene.
Knowledge of authentication and authorization protocols such as SAML, OAuth, OIDC, and Kerberos.
Working knowledge of how attackers abuse identity systems, including Kerberoasting, DCSync, AD CS abuse, and privilege escalation.
Experience analyzing identity telemetry in a SIEM, writing hunting and detection queries (e.g., KQL), and creating dashboards.
Ability to read and author basic scripts in at least one common language such as Python, PowerShell, or Bash.