Principal Identity Access and Zero Trust Architect - TS/SCI with Polygraph

GDIT is seeking an Enterprise Identity and Access Architect to lead the design and ownership of identity, authentication, authorization, privileged access, and Zero Trust access architectures across a major Department of War Program. This role is responsible for balancing robust security with a seamless user experience; ensuring identity controls reduce risk without introducing repetitive authentication, session disruptions, or operational workarounds.

Key Responsibilities

• Define enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities.

• Lead authentication-flow analysis and design for single-session mission applications, including token/session behavior, step-up authentication, timeout, reauthentication, and fallback.

• Design integration between Cisco ISE network access policy and Microsoft identity/device-compliance posture, including trust, claims, attributes, policy decision points, and failure behavior.

• Develop identity lifecycle controls for onboarding, transfer, termination, recertification, entitlements, privileged roles, service accounts, certificates, and automation identities.

• Review application and platform designs for authentication, authorization, secrets, token handling, least privilege, separation of duties, session security, and auditability.

• Define identity-related logging, monitoring, anomaly detection, evidence, and incident-response requirements with Security, Observability, and Service Operations.

• Partner with cloud, EUC, network, application, and ServiceNow architects to ensure identity decisions are integrated rather than locally optimized.

• Support RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness for identity capabilities.

• Lead identity architecture reviews, resolve cross-team policy conflicts, mentor engineers, and brief Government stakeholders on risk/user-experience trade-offs.

Required Qualifications

• Education: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field, or approved equivalent experience.
• Location: Onsite
• Clearance: Active TS/SCI with Polygraph
• 10+ years of identity, security, directory, or enterprise infrastructure experience, including 5+ years in identity/access architecture.
• Deep hands-on knowledge of Active Directory and Microsoft Entra ID, including federation/synchronization, Conditional Access, RBAC, PIM, MFA, device identity, and hybrid identity.
• Strong understanding of Zero Trust, identity-centric access, least privilege, continuous evaluation, device posture, and policy enforcement.
• Experience designing authentication and authorization for enterprise and mission applications using SAML, OAuth 2.0, OpenID Connect, Kerberos, certificates, or comparable mechanisms.
• Experience with privileged-access management, identity governance/recertification, service accounts, secrets, PKI, and non-person entities.
• Experience with Cisco ISE or a comparable NAC platform and integration between network access and enterprise identity/device posture.
• Working knowledge of RMF, NIST controls, STIGs, audit logging, incident response, classified data boundaries, and ATO impacts.
• Demonstrated technical leadership, structured decision-making, conflict resolution, mentoring, and ability to explain identity trade-offs to non-specialists.

Preferred Qualifications

• Microsoft Certified: Identity and Access Administrator Associate, Cybersecurity Architect Expert, CISSP and role-relevant ISSAP, ISSEP or CCSP.

• Experience with M365 GCC/GCC High, Azure Government, AVD, Intune, Defender, and mission-app integration in DoW/IC environments.

• Experience implementing single sign-on or session consolidation for high-security applications with measurable reduction in user friction.

• Experience integrating identity telemetry with Sentinel, Splunk/Elastic, Dynatrace, ServiceNow, or security analytics.

• Prior IC experience and familiarity with cross-domain or multi-enclave identity constraints.

GDIT IS YOUR PLACE

At GDIT, the mission is our purpose, and our people are at the center of everything we do.

• Growth: AI-powered career tool that identifies career steps and learning opportunities
• Support: An internal mobility team focused on helping you achieve your career goals
• Rewards: Comprehensive benefits and wellness packages, 401K with company match, and competitive pay and paid time off
• Community: Award-winning culture of innovation and a military-friendly workplace

OWN YOUR OPPORTUNITY Explore an enterprise IT career at GDIT and you’ll find endless opportunities to grow alongside colleagues who share your desire to drive operations forward.

#GDITcareers #OpportunityOwned

#WeAreGDIT #transitioningmilitary

#clearedjobs #veterans #Autobots

#IntelligenceEngineered