Identity & Access Management Engineer (PAM / Active Directory)

Job Title: Identity & Access Management Engineer (PAM / Active Directory)

Location: Hybrid – local to Fairfax, VA and able to go on site occasionally

Employment Type: Full-time, W-2

Status: Contingent upon contract award

Eligibility: Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation) – no active clearance required.

About the Role

Critical infrastructure runs on operational technology that was never designed with today’s threats in mind. Those systems sit on isolated networks at hundreds of facilities, and administrators still need secure ways to reach them. Someone has to build that access so it is controlled, audited, and resilient without slowing down operations. That’s where you come in.

Signal Hill Technologies is seeking a Senior IAM Engineer to design and deploy privileged remote access for a large federal critical-infrastructure client. As one of the first engineers on the program, you will own the privileged access capability from design through production rollout. You will build audited administrative access to OT assets at distributed sites, tied into enterprise Active Directory and Okta, that keeps working locally when a site loses its connection to central services.

Also known as a Privileged Access Management (PAM) Engineer, IAM Engineer, Identity Architect, Active Directory Engineer, or Cybersecurity Engineer, you’ll bring the identity focus to a hands-on cyber engineering role, working alongside our SIEM, PKI, and systems engineers.

You’ll also be a trusted technical voice with the client’s IT, CISO, networking, and system-owner teams. Getting a new capability through formal approval and into daily use is its own kind of engineering challenge, and doing it well is a real part of the job.

The ideal candidate is a Microsoft infrastructure engineer at heart, with years of on-premises Active Directory work behind them and hands-on time deploying enterprise privileged access tools. Experience with a major PAM solution such as CyberArk, BeyondTrust, or Delinea is expected; experience across more than one platform, or with evaluating and selecting a PAM tool, is a strong plus. Other experience that will set you apart: Active Directory migrations or consolidations in environments with tens of thousands of users, ADFS or Microsoft certificate services, Microsoft certifications such as MCSE, and work in OT, industrial control system, or isolated network environments.

Position Responsibilities

• Design and deploy an enterprise privileged remote access solution across a large, multi-site operational technology environment.
• Integrate privileged access with Active Directory and Okta for secure, seamless authentication.
• Build least-privilege and just-in-time access workflows, with password vaulting for privileged accounts.
• Configure session recording and audit logging that feed the central SIEM.
• Engineer resilient access that keeps working when sites lose connectivity, backed by tested recovery plans.
• Harden and maintain the PAM platform for performance and availability across every site.
• Produce the designs, runbooks, and security documentation that carry the system through approval (ATO).

Minimum Qualifications

• Public Trust eligible (U.S. citizenship or green card required and ability to pass a background investigation; no active clearance required).
• Strong technical writing and communication skills, with the ability to explain identity and access decisions to both technical and non-technical audiences.
• 5+ years of IT or cybersecurity engineering experience, including 2+ years of hands-on on-premises Active Directory engineering.
• Hands-on deployment of an enterprise PAM platform (e.g., CyberArk, BeyondTrust, Delinea) in a large environment, including password vaulting and privileged session management.
• Hands-on on-premises Active Directory engineering in a large enterprise (e.g., forest and domain design, group policy, privileged account tiering).
• Experience integrating Active Directory with Okta for SSO and MFA, using protocols such as SAML, OIDC, Kerberos, and LDAP.
• Experience with credential rotation and session monitoring.

Benefits

• Compensation: $150k–$185k annually (depending on experience)
• Company health plan
• 401(k) plan with employer match
• Paid holidays and paid time off
• Education reimbursement

How to Apply

Submit a detailed resume with complete month/year dates for every role (please note any employment gaps), plus all certifications, training, and degrees with the year and month earned.

About Signal Hill Technologies

Founded and led by veteran cyber operators, Signal Hill Technologies delivers advanced cybersecurity solutions to DoD, Intelligence Community, financial services, and critical infrastructure clients, with many years of experience defending both US Government and commercial clients against sophisticated, well-funded, motivated adversaries. We are relentless about real results and operationally proven expertise. Our mission is to provide the best technical solutions and hands-on support to address each customer's unique cyber risks.

Signal Hill Technologies is an equal opportunity employer. We do not discriminate based on race, color, religion, sex, national origin, age, disability, protected veteran status, or any other characteristic protected by applicable law.