ICAM Security Engineer

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We need to parse the description. Key info: - Role: ICAM / Identity Engineer, supporting L-CAP. - About the role: description of L-CAP, AI-first, SAFe/Agile, hybrid position requiring 3 days onsite, 2 days WFH if within commutable distance from Gaithersburg, MD; Eagan, MN; Egg Harbor Township, NJ; else 100% remote. - Responsibilities: list of tasks: integrate L-CAP services with government-provided ICAM services using OAuth 2.0 and OIDC; implement identity federation and user stores (Keycloak or equivalent); implement per-session authentication and authorization; implement mTLS, service mesh/workload identity, certificate lifecycle; design and implement RBAC/ABAC; implement authentication and session management for operational users; implement auth and authz audit logging; implement API gateway authorization; support security authorization and continuous monitoring by producing ICAM control evidence, resolving identity integration issues, leveraging AI-assisted development. - Core Technical Qualifications: list of qualifications: Bachelor's degree in Cybersecurity, CS, IT, or related with 4+ years experience (additional experience may be considered in lieu of degree); hands-on experience with OAuth 2.0 and OIDC; experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID; experience implementing RBAC and/or ABAC; working knowledge of PKI, certificate lifecycle, mTLS, service mesh identity; understanding of Zero Trust principles; experience implementing audit logging; proficiency in Java, Python, Go, or comparable; working knowledge of NIST SP 800-53 AC and AU controls; experience with Kubernetes and containerized service deployments; US citizenship required, ability to obtain and maintain Public Trust; must meet FAA facility and information system access requirements, including continuous US residency for at least 3 of previous 5 years. - Preferred / Desired Qualifications: list: Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II cert; Federal ICAM/FICAM experience, including PIV/CAC or agency ICAM integrations; experience with SAML 2.0 and SCIM provisioning; experience with Kubernetes RBAC and workload identity (SPIFFE/SPIRE); experience with service mesh implementation (Istio, Linkerd); experience with API gateway authorization policy (Kong, Apigee, or equivalent); familiarity with FIPS 140-3 validated cryptographic modules, HSM, enterprise key management; knowledge of privileged access management practices; experience in aviation, FAA, or other safety-critical environments; experience with SAFe or large-scale Agile delivery. - Why Leidos? (maybe not needed as a section; could be About the role? Actually "Why Leidos?" is marketing fluff; we could include under "About Leidos" maybe but not required. The instruction: include a section ONLY when posting has real specific content. "Why Leidos?" is generic marketing; but we could treat as "About Leidos" maybe but it's not a standard heading list. The allowed headings are: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should map content to those. - Pay Range: $87,100.00 - $157,450.00. Also note that it's a guideline. - Benefits: mention "Pay and benefits are fundamental... Employment benefits include competitive compensation, Health and Wellness programs, Income Protection, Paid Leave and Retirement." Also "More details are available at www.leidos.com/careers/pay-benefits." So we have benefits content. - Schedule: hybrid position requiring 3 days onsite and 2 days working from home, if within commutable distance; else 100% remote. So schedule info. - Requirements: maybe combine qualifications? The instruction says we can have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide what goes where. We have "Core Technical Qualifications" and "Preferred / Desired Qualifications". Could map to "Qualifications" (required) and maybe "Preferred Qualifications" but not a standard heading. Could put both under "Qualifications" (maybe separate sub-sections? But we only allowed headings; we could include both required and preferred under Qualifications, maybe using

with notes. "Skills": could list technical skills like OAuth, OIDC, Keycloak, RBAC/ABAC, PKI, mTLS, Zero Trust, audit logging, Java/Python/Go, NIST SP 800-53, Kubernetes, etc. But we already have qualifications covering many. Might be redundant. Better to put skills as separate if there is distinct skill list not covered elsewhere. The posting includes many technical skills; we could treat them as Skills. But we need to avoid duplication. Let's think: The posting includes "Core Technical Qualifications" which is essentially required qualifications. Then "Preferred / Desired Qualifications". So we could have a "Qualifications" section containing both required and preferred, maybe with subheadings? But we cannot add extra headings beyond the allowed list. However we could embed notes in

or

indicating required vs preferred. Alternatively, we could have "Requirements" for required qualifications, and "Qualifications" for preferred? But the instruction says use headings for those specific names. It doesn't forbid using both Requirements and Qualifications sections. So we can have: - About the role: description of role, mission, hybrid schedule maybe? Actually schedule is separate. - Responsibilities: list of duties. - Requirements: required qualifications (Core Technical Qualifications plus citizenship, residency, etc.) - Qualifications: preferred/desired qualifications. - Skills: maybe list specific technical skills (OAuth, OIDC, Keycloak, etc.) but that overlaps with requirements. Could combine. - Benefits: benefits description. - Pay: pay range. - Schedule: hybrid/remote details. We must not repeat job title as heading. Not include Job ID etc. We must remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "Why Leidos?" marketing fluff? It's not boilerplate but maybe not needed; but we could incorporate into About the role? The instruction: include a section ONLY when posting has real specific content. "Why Leidos?" is generic marketing but still specific to Leidos; but we already have About Leidos maybe not needed. Since we have About the role, we could skip Why Leidos. Also remove "ATMC" etc. Also remove "Original Posting September 21, 2026" etc. Also remove "For U.S. Positions: While subject to change..." etc. Also remove "Securing Your Data" scam warning. Also remove "Commitment to Non-Discrimination". Also remove "About Leidos" paragraph (maybe not needed). But we could keep a brief About Leidos if it's specific? It's generic but maybe okay. However instruction: remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate. About Leidos is not boilerplate but it's generic corporate description; could be considered boilerplate? Not sure. Safer to omit. Thus final HTML will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Now we need to extract content for each. About the role: Should describe the role, L-CAP, AI-first, SAFe/Agile, hybrid position details? Actually schedule separate. But we can include description of L-CAP, mission-critical platform, AI-first engineering mindset, SAFe/Agile ART, supporting government programs, need Public Trust, hybrid position (maybe mention schedule but we can keep brief). However schedule details will be in Schedule section; we can mention hybrid nature but not specifics. Let's craft:

About the role

Leidos is seeking an ICAM / Identity Engineer to join the Air Traffic Business Area within the Homeland Sector, supporting the development of the Leidos Common Automation Platform (L‑CAP). L‑CAP is a mission‑critical, future‑ready automation platform built on a hybrid cloud data mesh architecture that enables next‑generation air traffic management capabilities. The team follows an AI‑first engineering mindset and operates within a SAFe/Agile framework as part of an Agile Release Train delivering iterative value.

That seems good. Responsibilities: list of duties from "What You’ll Do" and later bullet points. We need to preserve all substantive information; do not invent or summarize away detail. So we need to include each bullet point as
• . Let's extract: - Integrate L-CAP services with government-provided ICAM services using OAuth 2.0 and OpenID Connect, including token issuance, validation, and claims mapping. - Implement and maintain identity federation and user stores (Keycloak or equivalent), including role-based test account provisioning. - Implement per-session authentication and authorization for user-to-service and service-to-service requests, enforcing default-deny access regardless of network location. - Implement mutual TLS (mTLS), service mesh/workload identity, and certificate lifecycle management, including issuance, rotation, expiration monitoring, and revocation. - Design and implement role-based (RBAC) and attribute-based (ABAC) access controls aligned to operational and support roles. - Implement authentication and session management for operational users, including sign-in/sign-out and time-on-position logging. - Implement authentication and authorization audit logging, including event capture, storage, and retrieval. - Implement API gateway authorization and ensure external-facing endpoints are registered and protected through the API management layer. - Support security authorization and continuous monitoring by producing ICAM control evidence, resolving identity integration issues across distributed services, and leveraging AI-assisted development and automation to improve quality and delivery. That's all. Now Requirements: required qualifications (Core Technical Qualifications plus citizenship, residency, etc.) Let's list: - Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or related field with 4+ years of relevant experience (additional experience, education and training may be considered in lieu of degree). - Hands-on experience with OAuth 2.0 and OpenID Connect, including token validation, introspection, and claims mapping. - Experience with enterprise identity providers and federation such as Keycloak, Okta, Ping, Microsoft Entra ID, or equivalent. - Experience implementing RBAC and/or ABAC within distributed applications. - Working knowledge of PKI, certificate lifecycle management, mutual TLS (mTLS), and/or service mesh identity. - Understanding of Zero Trust principles, including per-session authorization and default-deny service communication. - Experience implementing audit logging for access and authorization events. - Proficiency in Java, Python, Go, or a comparable programming/scripting language. - Working knowledge of NIST SP 800-53 Access Control (AC) and Audit and Accountability (AU) controls. - Experience with Kubernetes and containerized service deployments. - U.S. citizenship required, with the ability to obtain and maintain a Public Trust and successfully complete required government background investigations. - Must meet FAA facility and information system access requirements, including continuous U.S. residency for at least 3 of the previous 5 years. We should keep as
  • . Now Qualifications: preferred/desired qualifications. List: - Security+ CE, CySA+, or equivalent DoD 8570 IAT Level II certification. - Federal ICAM/FICAM experience, including PIV/CAC or agency ICAM integrations. - Experience with SAML 2.0 and SCIM provisioning. - Experience with Kubernetes RBAC and workload identity (SPIFFE/SPIRE). - Experience with service mesh implementation (Istio, Linkerd). - Experience with API gateway authorization policy (Kong, Apigee, or equivalent). - Familiarity with