Cybersecurity Engineer - ISSE/ISSO

About the role

The Senior ISSE/ISSO will design, implement, and maintain secure identity and access management architecture leveraging Okta and SailPoint across enterprise and mission systems. They will configure and harden Okta SSO, adaptive MFA, lifecycle management, and API access policies in accordance with security baselines. They will engineer SailPoint identity governance workflows, including access certifications, role mining, segregation-of-duties (SoD) policies, and automated provisioning/deprovisioning. They will integrate Okta/SailPoint with directory services, PKI/CAC authentication, and downstream applications via SCIM, SAML, and OIDC. They will conduct security control implementation and testing for identity systems in support of Risk Management Framework (RMF) Assessment & Authorization (A&A) packages.

Responsibilities

• Configure and harden Okta SSO, adaptive MFA, lifecycle management, and API access policies in accordance with security baselines.
• Engineer SailPoint identity governance workflows, including access certifications, role mining, segregation-of-duties (SoD) policies, and automated provisioning/deprovisioning.
• Integrate Okta/SailPoint with directory services (Active Directory/Azure AD), PKI/CAC authentication, and downstream applications via SCIM, SAML, and OIDC.
• Conduct security control implementation and testing for identity systems in support of RMF/A&A packages.
• Support vulnerability remediation, patch management, and secure configuration baselines (STIGs/CIS benchmarks) for IAM infrastructure.
• Partner with application owners and engineering teams to embed zero trust and least-privilege principles into identity workflows.
• Serve as the ISSO of record for identity management systems, maintaining continuous authorization to operate (ATO) status.
• Conduct and document risk assessments, POA&Ms, and continuous monitoring activities for assigned systems.
• Collaborate with the ISSM, AO, and assessment teams during A&A activities, audits, and inspections (NIST SP 800-53, RMF, FedRAMP as applicable).
• Monitor and report on security events, incidents, and access anomalies related to identity and access systems; support incident response as needed.
• Maintain audit-ready documentation for access reviews, certification campaigns, and compliance evidence collection.
• Ensure identity-related controls align with applicable frameworks (NIST 800-53, NIST 800-63, ICD 503, DoD RMF, or agency-specific requirements).
• Brief leadership and stakeholders on identity security posture, risk, and remediation status.

Requirements

• Active DoD Secret clearance required at time of hire.
• A Bachelor's degree plus 8 years of information systems security experience, with demonstrated ISSE and/or ISSO responsibilities OR an Associate's degree and 10 years of information systems security experience, with demonstrated ISSE and/or ISSO responsibilities OR a Master's degree and 6 years of information systems security experience, with demonstrated ISSE and/or ISSO responsibilities.
• DoD 8570 IAT Level II or III certification (Security+, CySA+, CISSP, or equivalent).
• Demonstrated subject-matter expertise across Identity, Credential, and Access Management (ICAM) solutions broadly – not limited to any single vendor product – spanning identity governance, credentialing/PKI, federation, directory services, and access management architecture.
• Hands-on production experience configuring and administering Okta (SSO, MFA, workflows, lifecycle management).
• Hands-on production experience with SailPoint (IdentityNow or IdentityIQ) for identity governance, certifications, and provisioning.
• Working knowledge of NIST SP 800-53, RMF, and Assessment & Authorization (A&A) processes.
• Experience with SAML, OIDC, SCIM, and federated identity integration patterns.
• Experience with PKI/PIV/CAC-based credentialing and certificate-based authentication as part of an enterprise ICAM strategy.
• Understanding of adjacent ICAM capabilities such as privileged access management (PAM), directory services (Active Directory/Azure AD/LDAP), and role-based/attribute-based access control (RBAC/ABAC), and how Okta/SailPoint integrate with them.
• Ability to assess, integrate, and troubleshoot ICAM solutions and architectures beyond the current Okta/SailPoint toolset, including evaluating new or legacy identity platforms as mission needs evolve.
• Familiarity with STIGs, CIS benchmarks, and secure configuration management.
• Strong written communication skills for security documentation (SSPs, POA&Ms, risk assessments).

Qualifications

• Must be able to work Central Time Zone work hours.
• The ability to travel up to 25% (CONUS).
• Must be okay traveling to San Antonio, TX on a customer needed basis.

Skills

• CISSP, CISM, or SailPoint/Okta vendor certifications (Okta Certified Administrator, SailPoint IdentityNow Engineer).
• Broader ICAM platform experience beyond Okta/SailPoint (Ping Identity, ForgeRock, Microsoft Entra ID, CyberArk, or similar IAM/PAM/governance products), demonstrating vendor-agnostic ICAM fluency.
• Experience integrating IAM platforms with PKI/CAC/PIV authentication.
• Familiarity with zero trust architecture (ZTA) principles and DoD Zero Trust reference architecture.
• Scripting/automation experience (PowerShell, Python) for identity workflow automation.

Benefits

To review Serco benefits please visit: https://careers.serco-na.com/us/en/what-we-offer.