# Enterprise Identity and Access Architect

**Company**: GDIT
**Location**: Chantilly, VA
**Work arrangement**: onsite
**Experience**: senior
**Job type**: full-time
**Salary**: $161,500 - $218,500
**Category**: IT
**Industry**: Technology

**Apply**: https://gdit.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/USA-VA-Chantilly/Principal-Identity-Access-and-Zero-Trust-Architect---TS-SCI-with-Polygraph_RQ231746-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_6711fd88-5f5

## Description

GDIT is seeking an Enterprise Identity and Access Architect to lead the design and ownership of identity, authentication, authorization, privileged access, and Zero Trust access architectures across a major Department of War Program.

This role is responsible for balancing robust security with a seamless user experience; ensuring identity controls reduce risk without introducing repetitive authentication, session disruptions, or operational workarounds.

**Key Responsibilities**

- Define enterprise identity principles, target architecture, patterns, decision records, and exception criteria across Active Directory, Entra ID, PKI, federation, MFA, Conditional Access, RBAC, PIM/PAM, and service identities.

- Lead authentication-flow analysis and design for single-session mission applications, including token/session behavior, step-up authentication, timeout, reauthentication, and fallback.

- Design integration between Cisco ISE network access policy and Microsoft identity/device-compliance posture, including trust, claims, attributes, policy decision points, and failure behavior.

- Develop identity lifecycle controls for onboarding, transfer, termination, recertification, entitlements, privileged roles, service accounts, certificates, and automation identities.

- Review application and platform designs for authentication, authorization, secrets, token handling, least privilege, separation of duties, session security, and auditability.

- Define identity-related logging, monitoring, anomaly detection, evidence, and incident-response requirements with Security, Observability, and Service Operations.

- Partner with cloud, EUC, network, application, and ServiceNow architects to ensure identity decisions are integrated rather than locally optimized.

- Support RMF/ATO/cATO artifacts, Zero Trust maturity evidence, control implementation, and inspection readiness for identity capabilities.

- Lead identity architecture reviews, resolve cross-team policy conflicts, mentor engineers, and brief Government stakeholders on risk/user-experience trade-offs.

**Required Qualifications**

- Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Computer Engineering, or related field, or approved equivalent experience.

- 10+ years of identity, security, directory, or enterprise infrastructure experience, including 5+ years in identity/access architecture.

- Deep hands-on knowledge of Active Directory and Microsoft Entra ID, including federation/synchronization, Conditional Access, RBAC, PIM, MFA, device identity, and hybrid identity.

- Strong understanding of Zero Trust, identity-centric access, least privilege, continuous evaluation, device posture, and policy enforcement.

- Experience designing authentication and authorization for enterprise and mission applications using SAML, OAuth 2.0, OpenID Connect, Kerberos, certificates, or comparable mechanisms.

- Experience with privileged-access management, identity governance/recertification, service accounts, secrets, PKI, and non-person entities.

- Experience with Cisco ISE or a comparable NAC platform and integration between network access and enterprise identity/device posture.

- Working knowledge of RMF, NIST controls, STIGs, audit logging, incident response, classified data boundaries, and ATO impacts.

- Demonstrated technical leadership, structured decision-making, conflict resolution, mentoring, and ability to explain identity trade-offs to non-specialists.

**Benefits**

- Comprehensive benefits and wellness packages

- 401K with company match

- Competitive pay and paid time off

- Full flex work weeks where possible

- Paid parental, military, bereavement, and jury duty leave

- Short and long-term disability benefits, life, accidental death and dismemberment, personal accident, critical illness, and business travel and accident insurance

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- Active Directory
- Identity Access Management
- Zero Trust
- Microsoft Entra ID
- Cisco ISE
- RMF
- NIST controls
- STIGs

### Nice to have
- Microsoft Certified: Identity and Access Administrator Associate
- Cybersecurity Architect Expert
- CISSP
- ISSAP
- ISSEP
- CCSP
- M365 GCC/GCC High
- Azure Government
- AVD
- Intune
- Defender

---

Source: [Apply at gdit.wd5.myworkdayjobs.com](https://gdit.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/USA-VA-Chantilly/Principal-Identity-Access-and-Zero-Trust-Architect---TS-SCI-with-Polygraph_RQ231746-1?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)