Identity Access Management (IAM) Engineer

This is a remote position.

RayTek is seeking an Identity Access Management Engineer to build and run the identity fabric at the center of a mission-application modernization program for a Department of War customer: one sign-on, one work surface, and a repeatable pattern for onboarding legacy applications to a shared platform. Every user and every application passes through this layer, so it gates the rest of the platform.

The fabric is a Keycloak broker that holds no local credentials. It federates to the customer's existing identity providers for CAC/PIV and identity-proofed MFA, issues one normalized token, and hands users into each application with short-lived, single-audience tokens. Success means users sign on once and reach every onboarded application with the right access, and the identity controls pass security review on the first submission.

Key responsibilities

Identity broker build and operations

• Design, deploy, and operate Keycloak as a credential-free federation broker in AWS GovCloud on Kubernetes, with high availability, backup, and upgrade paths.
  
• Federate to the customer's OIDC and SAML identity providers, including CAC/PIV (PKI) and non-PKI multi-factor paths.
  
• Build claim mappers and assurance levels that produce one normalized token: user type, roles, organization, and assurance.
  
• Register the platform as a relying party with the customer's identity providers and manage certificates, keys, and secrets rotation.
  

Token exchange and authorization

• Implement OAuth 2.0 Token Exchange (RFC 8693) for short-lived, single-audience tokens so the browser never holds an application's token.
  
• Implement silent sign-on into existing applications without rewriting them.
  
• Work with the Platform Architect on attribute-based, least-privilege authorization with Open Policy Agent: claims, policy inputs, and decision logging.
  

Application onboarding

• Write the identity integration guide and templates that application teams use to join the platform.
  
• Lead identity discovery with application owners: current login method, roles, and the path to the shared broker.
  
• Troubleshoot sign-on and access issues across onboarded applications.
  

Security and evidence

• Write automated tests for role switching, revocation, prohibited actions, and token lifetime, run in the CI pipeline.
  
• Produce the identity portions of the security authorization (RMF) evidence with the security lead.
  
• Present identity design and status at sprint demonstrations and phase-exit reviews.
  

Requirements

Required qualifications

• Active Secret clearance.
  
• Bachelor's degree in computer science or a related field, or equivalent experience, and 10+ years in software or systems engineering, with 5+ years focused on identity and access management.
  
• Deep hands-on Keycloak experience in production: realms, identity brokering, mappers, authentication flows, clustering, and upgrades.
  
• Strong working knowledge of OIDC, OAuth 2.0, SAML 2.0, and PKI / smart-card (CAC/PIV) authentication.
  
• Experience integrating single sign-on into legacy applications without rewriting them.
  
• Experience running identity services on Kubernetes in a regulated or Government cloud.
  

Desired qualifications

• Experience with DoD identity services (DISA E-ICAM, D-ICAM) or other Federal ICAM programs.
  
• OAuth 2.0 Token Exchange (RFC 8693) in production.
  
• Policy-as-code with Open Policy Agent / Rego.
  
• Zero-trust architecture experience; familiarity with NIST SP 800-63 assurance levels.
  
• Java (Keycloak SPI development) or Go; AWS GovCloud; Helm; OpenTofu or Terraform.
  
• Experience producing RMF authorization evidence for identity controls.
  
• Security+ or CISSP (DoD 8140 baseline).
  

Benefits

Benefits

RayTek Employee Benefits Highlights

Health and Wellness

• UnitedHealthcare Choice Plus HSA plan with 100% in-network preventive care and nationwide network and out-of-network coverage
  
• 24/7 virtual visits and behavioral health support, including the Sanvello app and in-person or virtual therapy
  
• Dental PPO with a $1,500 annual max and 100% preventive coverage 
  
• Vision plan with $10 exams, a $150 frame allowance, and a $150 contact lens allowance
  
• Exercise reimbursement up to $360 per year
  

Financial Security

• Employer HSA match up to $1,200 (individual) or $2,400 (family) annually
  
• 401(k) plan with immediate eligibility and 100% vesting
  
• Employer 401(k) match up to 4% after 1 year
  
• Company-paid Life & AD&D at 1x annual salary, up to $100,000 
  
• Company-paid Short-Term Disability: 60% of pay, up to $1,000 weekly, for up to 13 weeks 
  
• Company-paid Long-Term Disability: 50% of pay, up to $8,000 monthly
  

Work-Life Balance

• 11 paid federal holidays (may vary by program)
  
• PTO accrual from day one
  
• Remote flexibility for eligible positions
  

Employee & Family Support

• Day-one eligibility for all benefits for full-time employees (30+ hours/week)
  
• Dependent coverage up to age 26
  
• Employee Assistance Program (EAP), available 24/7, with confidential counseling, legal, and financial support
  
• Travel Assistance Program for emergency medical care, evacuation, and global support
  
• Referral, commendation, and milestone service bonuses