{"id":111683,"url":"https://alion.io/job/icf-iam-lead","title":"IAM Lead","company":{"id":2632,"name":"ICF","domain":"icf.com","url":"https://alion.io/company/icf","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":17,"ghost_share":0,"stale_share":0,"repost_share":0.059,"time_to_fill_p50_days":19,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Washington, United States","United States"],"countries":["US"],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":108006,"max":183610,"currency":"USD","period":"year","gross":null,"usd_annual":183610},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Okta","optional":false},{"name":"VPN","optional":false},{"name":"Zero Trust","optional":false},{"name":"NIST 800-53","optional":true}],"status":"live","first_seen_at":"2026-08-13T00:00:00Z","employer_posted_date":"2026-08-13","last_verified_at":"2026-10-17T21:41:38Z","board_verified":true,"closed_at":null,"days_open":65,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":65},"description":"This role is contingent upon a contract award.\nICF is seeking an IAM Lead to architect, implement, andoperatethe identity and access management platform for a federal technology program.Reporting toengineering leadership, this role is the subjectmatterauthority on how users, devices, and applications authenticate and are authorized across a cloud-first, Zero Trust environment. The IAM Lead owns the full identity lifecycle, from onboarding automation to privileged access controls to external identity federation.\nThe ideal candidate is a senior identity engineer who has built and operated IAM programs in federal cloud environments. This is a deeply technical role. The right candidate understands not just the tooling but the underlying standards, can implement NIST identity assurance requirements, and can hold their own with cybersecurity and enterprise architecture teams on access policy design.\nJob Location: This is a remote-friendly position with occasional onsite requirements in the Washington, DC Metro area.\nThis position requires that the job be performed in the United States.If you accept this position, you should note that ICF does monitor employee work locations and blocks access from foreign locations/foreign IP addressesand alsoprohibits personal VPN connections.\nWhat You'll Be Doing\nArchitect, configure, andmaintainidentity platforms including Entra ID, Entra External ID, and Okta, covering authentication, authorization, provisioning, and lifecycle management across all users, applications, and devices.\n\nConfigure and enforce phishing-resistant authentication for all users, including passkeys, FIDO2 security keys,WebAuthn, and biometrics. Drive the transition away from legacy authentication methods toward a fullypasswordlessposture.\n\nDefine and implement Zero Trust access rules based on user risk, device health, location, and behavior using risk-based and conditional access policies.\n\nDesign, configure, andoperateauthorization models including RBAC, PBAC, and ABAC, with fine-grained permissions and attribute-based access rules aligned to job function and least-privilege principles.\n\nManage privileged accounts and administrative roles using privileged access management (PAM) and just-in-time elevation, ensuring that standing admin access isminimizedand all elevated access is logged and time-bound.\n\nBuild andmaintainHR-driven joiner, mover, and leaver automation, including automated provisioning, license assignment, role changes, access revocation, and data archival triggered by HR system events.\n\nFederate external identities including partners, contractors, and external collaborators using Entra External ID or equivalent, including self-service registration,verificationworkflows, and consent management.\n\nConfigure identity proofing and verification to NIST IAL and AAL levels whererequired, coordinating with cybersecurity and compliance teams on assurance requirements.\n\nIntegrate applications and APIs with identity platforms using OIDC, OAuth2, SAML, and SCIM for single sign-on and automated provisioning.\n\nMonitor sign-in activity, risk signals, and anomalies. Respond to identity-related incidents including account takeover, phishing, access abuse, and fraud in coordination with the cybersecurity team.\n\nMaintain identity data quality and consistency across directories, HR systems, and applications, including synchronization, schema management, and attribute mapping.\n\nSupport compliance and audit activities by producing access reports, certifications, attestations, and evidence of controls.\n\nDocumentidentity architectures, configurations, standards, and runbooks. Provide guidance to application teams on how toonboard tocentral identity platforms and implement authentication best practices.\n\nMinimumRequirements\nBachelor's degree or equivalent\n\n7+ years of experience in identity and access management engineering or a related discipline\n\n3+ years of hands-on experience designing and operating Entra ID or Okta in production environments, including conditional access, lifecycle management, and federation\n\n2+ years implementing PAM solutions and just-in-time elevation controls for privileged accounts\n\n2+ years configuring authorization models including RBAC, PBAC, or ABAC in enterprise environments\n\n2+ years supporting federal IT programs in HHS, NIH, FDA, or other health-focused agencies\n\nU.S. Citizenshiprequired due to federal contract requirements\n\nAbility to obtain andmaintaina Public Trust background investigation\n\nCandidate mustresidein the US,be authorized towork in the US, and work must be performed in the US\n\nPreferred Qualifications\nExperience implementing NIST SP 800-63 identity assurance levels (IAL/AAL) in a federal context\n\nExperience federating external identities using Entra External ID, including self-service registration and consent workflows\n\nFamiliarity with FISMA, NIST 800-53, and Zero Trust architecture requirements as they apply to identity and access\n\nExperience integrating identity platforms with HR systems for automated joiner, mover, and leaver workflows\n\nRelevant certifications such as Microsoft Certified: Identity and Access Administrator, Okta Certified Administrator, or equivalent\n\nExperience supporting identity incident response including account takeover, phishing, and access abuse investigations\n\nBot and Third-Party Applications\nPlease note that this application must be submitted directly by the applicant for consideration. Failure to do so may result in the application being excluded for consideration. Applicants needing an accommodation for disability or religious purposes in connection with the application process should contact  for assistance.\nWorking at ICF\nICF is a global advisory and technology services provider, but we’re not your typical consultants. We combine unmatched expertise with cutting-edge technology to help clients solve their most complex challenges, navigate change, and shape the future.We can only solve the world's toughest challenges by building a workplace that allows everyone to thrive. We are an equal opportunity employer.Together, our employees are empowered to share theirexpertiseand collaborate with others to achieve personal and professional goals. For more information, please read our EEO policy.\nWe will consider for employment qualified applicants with arrest and conviction records.\nReasonable Accommodations are available, including, but not limited to, for disabled veterans, individuals with disabilities, and individuals withsincerely heldreligious beliefs, in all phases of the application and employment process. To requestan accommodation,please email  and we will be happy toassist. All information you provide will be kept confidential and will be used only to the extentrequiredto provide needed reasonable accommodations.\nRead more about workplace discrimination rights or our benefit offerings which are included in the Transparency in (Benefits) CoverageAct.\nCandidate AI Usage Policy\nAt ICF, we are committed to ensuring a fair interview process for all candidates based on their own skills and knowledge. As part of this commitment, the use of artificial intelligence (AI) tools to generate orassistwith responses during interviews (whether in-person or virtual) is notpermitted. This policy is in place tomaintainthe integrity and authenticity of the interview process.\nHowever, we understand that some candidates may require accommodationthat involves the use of AI. Ifsuch anaccommodation is needed, candidates are instructed to contact us in advance at . Weare dedicated to providingthe necessary support to ensure that all candidates have an equal opportunity to succeed.\nPay Range - There are multiple factors that are considered in determining final payfor a position, including, but not limited to, relevant work experience, skills, certifications and competencies that align to the specified role, geographic location, education and certifications as well as contract provisions regarding labor categories that are specific to the position.\nThe pay range for this position based on full-time employment is:\n$108,006.00 - $183,610.00DC Remote Office (DC99)","description_format":"text","description_chars":8255,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":true,"languages":[]},"benefits":[],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Energy Efficiency","Digital Government","Information Security","Management Consulting"],"lifecycle":[{"event":"open","at":"2026-08-13T00:00:00Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.502,"p_room":0.28,"age_days":65,"expected_fill_days":19,"reasons":["conf:0","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":183610,"is_top_pay":false},"html_url":"https://alion.io/job/icf-iam-lead","json_url":"https://alion.io/job/icf-iam-lead.json","meta":{"generated_at":"2026-10-17T22:08:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":7183,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2632},"rest":"https://alion.io/mcp/rest/get_company?id=2632"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ficf-iam-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ficf-iam-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ficf-iam-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/icf-iam-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ficf-iam-lead"}]}