Cloud Identity and Security Engineer

Job description

<p>Dark Wolf is seeking a mid-level Cloud Identity & Security Engineer to manage and automate our access governance across hybrid identity engines and AWS cloud environments. In this role, you will be responsible for administering end-to-end AAA (Authentication, Authorization, and Accounting) controls using Infrastructure as Code (Terraform). You will configure and maintain group memberships, repository permissions, secrets management, and enterprise Single Sign-On (SSO) integrations spanning PingFederate, Keycloak, GitLab, AWS Landing Zone Accelerator (LZA), and AWS IAM Identity Center (IDC).</p>
<h3>Key Responsibilities</h3>
<ul>
<li>Authentication & Identity Engine Management (BYOI):</li>
<ul>
<li>Administering identity federation and user authentication workflows across PingFederate and Keycloak.</li>
<li>Integrating multi-factor authentication (MFA) and Single Sign-On (SSO) protocols (SAML 2.0, OIDC) between enterprise identity providers and cloud services.</li>
<li>Provisioning and maintaining user accounts, group assignments, and directory memberships across identity platforms.</li>
</ul>
<li>Authorization & Access Control (AWS & GitLab):</li>
<ul>
<li>Managing fine-grained permission models, roles, and group memberships within AWS IAM Identity Center (IDC) and GitLab repositories/groups.</li>
<li>Implementing and maintain landing zone configuration changes through AWS Landing Zone Accelerator (LZA) to enforce organizational boundary policies and Service Control Policies (SCPs).</li>
<li>Enforcing Least Privilege access models across AWS CodeCommit, development repositories, and cloud workloads.</li>
</ul>
<li>Secrets Management & Accounting:</li>
<ul>
<li>Configuring and maintain key-value secrets, database credentials, and API keys within AWS Secrets Manager, ensuring automated rotation and secure access policies.</li>
<li>Auditing identity lifecycle workflows, repository permissions, and access logs to ensure compliance with security baselines.</li>
</ul>
<li>Infrastructure as Code (IaC) & Automation:</li>
<ul>
<li>Codifying identity resources, group definitions, access policies, and cloud infrastructure using Terraform.</li>
<li>Automating user onboarding/offboarding pipelines and permission requests across GitLab, AWS, and PingFederate/Keycloak.</li>
</ul>
</ul>
<h3>Qualifications & Requirements</h3>
<ul>
<li>2+ years of hands-on experience in cloud identity management, IAM, or cloud infrastructure operations.</li>
<li>Practical knowledge of federated identity concepts (SAML, OIDC), PingFederate, Keycloak, and AWS IAM Identity Center (IDC).</li>
<li>Strong proficiency with Terraform for provisioning cloud resources, IAM policies, and identity group memberships.</li>
<li>Hands-on experience managing permissions in GitLab (groups/projects) and working with AWS CodeCommit, AWS Secrets Manager, and AWS Landing Zone Accelerator (LZA).</li>
<li>Solid understanding of AAA principles, RBAC/ABAC models, and identity lifecycle management.</li>
<li>AWS Certified Security – Specialty, AWS Certified Solutions Architect – Associate, or Ping Identity / Keycloak certifications.</li>
<li>Bachelor’s degree in Computer Science, Information Technology, or a related field. </li>
<li style="font-weight: bold;"><strong>US Citizenship and an active Top Secret/SCI security clearance required. </strong></li>
</ul>
<p>The estimated salary range for this position is $90,000.00 - $150,000.00, commensurate on experience and technical skillset. </p>
<p>We are strictly looking for direct, full-time W2 employees. We do not engage with third-party staffing agencies, C2C, or 1099 independent contractors for this role.</p>
<p>We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories.<br> <br>In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire.</p>