Zero Trust ICAM & PKI SME

We need to output HTML fragment with sections: headings

for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections if posting has real specific content. We need to parse the job description and extract relevant content. The posting includes: - Job Description: (some intro) - "Advance how our customers operate while you advance your career..." etc. That's about the role. - "MEANINGFUL WORK AND PERSONAL IMPACT" etc. - "HOW A ZERO TRUST ICAM & PKI SME WILL MAKE AN IMPACT" then responsibilities broken into three pillars. - "WHAT YOU’LL NEED TO SUCCEED" includes clearance, citizenship, education, certification, experience, technical competencies. - "Desired Skills & Qualifications" includes some. - Travel Requirements: Required USCENTCOM remote location support of up to 10% Travel during the Year to OCONUS Locations - Company Overview etc. - Salary range: $129,813 - $172,500. - Scheduled Weekly Hours: 40 - Travel Required: Less than 10% - Telecommuting Options: Onsite Work Location: USA FL MacDill AFB - Additional Work Locations: (none given) - Total Rewards At GDIT: benefits description. - Identity Verification Process etc. - About Our Work etc. - Equal Opportunity Employer etc (boilerplate to remove). We need to remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. We need to preserve all substantive information. We need to use

for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to decide which sections to include based on content. We have: - About the role: we have introductory paragraphs: "Advance how our customers operate while you advance your career..." and "MEANINGFUL WORK AND PERSONAL IMPACT". Could be combined. - Responsibilities: the detailed responsibilities under three pillars. - Requirements: maybe the "WHAT YOU’LL NEED TO SUCCEED" includes clearance, citizenship, education, certification, experience. Also technical competencies. - Qualifications: maybe similar to Requirements? But we can combine. - Skills: maybe "Desired Skills & Qualifications" and technical competencies. - Benefits: Total Rewards description. - Pay: salary range. - Schedule: Scheduled Weekly Hours: 40, Travel Required: Less than 10%, Telecommuting Options: Onsite Work Location: USA FL MacDill AFB. Could be schedule section. We must not include headings with filler like "commensurate with experience". Not needed. We must not repeat job title as heading. We must not put Job ID/requisition numbers as headings. We must output only HTML fragment. We need to use

• for any list of duties/requirements/benefits, and

  for prose. We need to preserve all substantive information; do not invent or summarize away detail. We need to remove duplicated lines. Let's extract content. First, About the role: From posting: "Advance how our customers operate while you advance your career. Join GDIT as a Zero Trust ICAM & PKI SME and build an impactful career in enterprise IT, collaborating with people who are driven and resourceful like you. MEANINGFUL WORK AND PERSONAL IMPACT As a Zero Trust ICAM & PKI SME, the work you do at GDIT will be impactful to the mission of supporting infrastructure security on the CITS contract for USCENTCOM. You will play a crucial role in leading the engineering, deployment, and operational integration of identity-centric, credentialing, and access control solutions across USCENTCOM’s network enclaves, aligned with DoD Zero Trust principles." We can combine into a paragraph. Maybe also include "HOW A ZERO TRUST ICAM & PKI SME WILL MAKE AN IMPACT" but that's heading for responsibilities. Thus About the role: two paragraphs. Now Responsibilities: The content under "HOW A ZERO TRUST ICAM & PKI SME WILL MAKE AN IMPACT Your Responsibilities Span Across The Three Core ICAM Pillars:" then three pillars with bullet-like sentences. We need to turn each duty into

• items. Could group by pillar but still list. We need to preserve all substantive information; we can break each sentence into list items. Let's extract responsibilities: Identity Management (Identity Lifecycle & Directory Services): - Design, implement, and maintain enterprise Identity Management solutions, prioritizing DISA’s enterprise solution to ensure seamless integration with Zero Trust architectures. - Architect and manage Master User Records (MUR), directory services (e.g., Active Directory), and Automated Account Provisioning (AAP) pipelines. - Troubleshoot complex identity synchronization, profile mapping, and lifecycle workflows across heterogeneous enclaves and mission partners. - Build, deploy, and maintain identity connectors and integrations with enterprise HR/authoritative data sources and cloud environments. - Maintain system documentation, data dictionaries, and SOPs for identity lifecycle management tasks. Credentialing & PKI (Authenticators, Non-Person Entities & Cryptography): - Design, engineer, and operate enterprise Public Key Infrastructure (PKI) solutions aligned with DoD/NSS PKI standards, CNSSP-1300, and CJCSM requirements. - Configure, harden, and maintain Certification Authorities (CAs), Registration Authorities (RAs), Validation Authorities (OCSP), and Hardware Security Modules (HSMs). - Architect and operationalize enterprise Certificate Lifecycle Management (CLM) processes, automating certificate issuance, renewal, and revocation across web servers, endpoints, and secure communication channels. - Implement Network Device Enrollment and automated Non-Person Entity (NPE) credentialing utilizing protocols such as SCEP, EST, and ACME. - Lead PKI-enablement for enterprise applications, network appliances, and workloads to enforce mutual TLS (mTLS) and smart-card/phishing-resistant MFA (CAC/PIV, hardware tokens). - Maintain disaster recovery, business continuity, and key recovery/custody plans for cryptographic infrastructure. Access Management & Governance (Authorization, Federation & PAM): - Configure, enforce, and optimize fine-grained access control models, including Role-Based (RBAC), Attribute-Based (ABAC), Policy-Based (PBAC), and Identity-Based Access Control (IBAC). - Lead the deployment and operational administration of Privileged Access Management (PAM) platforms (e.g., Delinea) to safeguard privileged accounts and enforce just-in-time access. - Implement Identity Governance and Administration (IGA) solutions (e.g., SailPoint) for access certifications, segregation of duties (SoD), and role mining. - Troubleshoot complex federation and Single Sign-On (SSO) integrations utilizing modern protocols (SAML 2.0, OAuth 2.0, OIDC). - Collaborate with multi-disciplinary cybersecurity teams to enforce continuous authentication and dynamic authorization in line with Zero Trust principles. Cross-Pillar Operations & Compliance: - Perform regular maintenance, vulnerability scanning, security STIG remediation, and patching across all ICAM and PKI server environments. - Ensure strict adherence to DoD ICAM policies, DISA STIGs, FIPS cryptographic benchmarks, and DoD Zero Trust reference architectures. - Interface with third-party vendors (e.g., F5, Microsoft, SailPoint, Delinea, Keyfactor, Thales) for tier-3/escalated troubleshooting. - Produce management reports, audit metrics, compliance packages, and system administration runbooks. We should include all. Now Requirements: "WHAT YOU’LL NEED TO SUCCEED Bring your technology expertise and drive for innovation to GDIT. The Zero Trust ICAM & PKI SME must have: Clearance: Active Secret Citizenship: U.S. Citizenship required Education: Bachelor's Degree in a related discipline (Cybersecurity or Information Assurance concentration preferred) or six (6) years of real-world or military experience in information assurance, network security, or systems administration. Certification: Applicable DoD 8140 / DoD 8570 IAT Level II/III or IAM Level II/III Certification (e.g., Security+ CE, CASP+, CISSP) along with relevant role-based credentials (e.g., CIAM, CIGE, CIMP, Microsoft Certified: Identity and Access Administrator Associate, or Okta Certified Professional). Experience: 10+ years of related engineering and operations experience in enterprise IT and cybersecurity." Also technical competencies by pillar. We could treat Requirements as the clearance, citizenship, education, certification, experience. And Qualifications maybe the technical competencies? But the instruction says use headings for Requirements, Qualifications, Skills. We need to decide. We could put: - Requirements: Clearance, Citizenship, Education, Certification, Experience. - Qualifications: Technical Competencies by Pillar (maybe split into sub-sections? but we only have heading; we could list them as
  items. - Skills: Desired Skills & Qualifications (the bullet list after "Desired Skills & Qualifications"). Alternatively, we could combine Requirements and Qualifications into one but we need to follow instruction: use headings for those sections only if posting has real specific content. It does. Thus we will have sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Now extract each. Requirements content: - Clearance: Active Secret - Citizenship: U.S. Citizenship required - Education: Bachelor's Degree in a related discipline (Cybersecurity or Information Assurance concentration preferred) or six (6) years of real-world or military experience in information assurance, network security, or systems administration. - Certification: Applicable DoD 8140 / DoD 8570 IAT Level II/III or IAM Level II/III Certification (e.g., Security+ CE, CASP+, CISSP) along with relevant role-based credentials (e.g., CIAM, CIGE, CIMP, Microsoft Certified: Identity and Access Administrator Associate, or Okta Certified Professional). - Experience: 10+ years of related engineering and operations experience in enterprise IT and cybersecurity. We can put each as
  • . Now Qualifications: Technical Competencies by Pillar. We have three pillars with bullet points. We could list them as items under Qualifications. But we already used Responsibilities for the duties; Qualifications could be the technical competencies. Thus Qualifications: list of technical competencies. Let's extract: Identity Management: - 10+ years of experience in enterprise identity architectures and directory infrastructure (Active Directory, LDAP). - Deep understanding of Master User Records (MUR), Identity Governance & Administration (IGA platforms such as SailPoint), and automated provisioning workflows. - Familiarity with DISA enterprise identity solutions and federal identity federation models. Credentialing & PKI: - In-depth expertise in Public Key Infrastructure (PKI) concepts: X.509 certificates, CA trust hierarchies, Certificate Revocation Lists (CRLs), and Online Certificate Status Protocol (OCSP). - Hands-on engineering experience administering enterprise CA platforms (e.g., Microsoft AD CS, Keyfactor) and integrating with DoD/Federal PKI (FPKI). - Direct experience with Certificate Lifecycle Management (CLM) tools and automated enrollment protocols (SCEP, EST, ACME). - Experience with CAC/PIV middleware, hardware tokens, and Hardware Security Modules (HSMs) (e.g., Thales/SafeNet). Access Management & Governance: - Advanced proficiency in designing and implementing access control models (RBAC, ABAC, PBAC, and IBAC). - Hands-on experience configuring and managing Privileged Access Management (PAM) suites (e.g., Delinea). - Strong understanding of modern authentication protocols and federation mechanisms (SAML 2.0, OAuth, OpenID Connect, Kerberos