ICAM Controls SME

ICAM Controls Subject Matter Expert (SME)

Location: Washington, DC
Employment Type: Full-Time
Clearance: Ability to obtain and maintain a Government position of trust/Public Trust determination, Common Access Card (CAC), and NIPRNet access
Salary Range: $135,000–$165,000 annually

Position Summary

Digital Global Connectors (DGC) is seeking an experienced Identity, Credential, and Access Management (ICAM) Controls Subject Matter Expert (SME) to support the Department of the Air Force (DAF) ICAM Program Management Office (PMO) in a System and Organization Controls (SOC) 1 audit-readiness capacity.

The ICAM Controls SME will support the evaluation, documentation, testing, and continuous improvement of enterprise identity governance and access management controls. This individual will focus on identity lifecycle management, role and attribute mapping, Segregation of Duties (SoD), privileged access governance, and technical control evidence supporting the DAF's financial audit-readiness objectives.

The specialist will work closely with Government stakeholders, identity governance teams, Privileged Access Management (PAM) organizations, operations and sustainment (O&S) personnel, and external service providers to evaluate control effectiveness and develop defensible, traceable audit evidence.

The ideal candidate possesses hands-on experience with Okta Identity Provider (IdP) and SailPoint IdentityIQ, strong knowledge of federal identity governance requirements, and demonstrated ability to translate complex technical configurations into clear control narratives and audit evidence suitable for Independent Public Accountant (IPA) review.

Key Responsibilities

Identity Lifecycle Management & Control Evaluation

• Evaluate and document enterprise identity lifecycle management processes, including joiner, mover, and leaver workflows.
• Decompose identity lifecycle processes into auditable control points, identifying the system of record, initiating triggers, workflows, approval authorities, and completion evidence.
• Assess the effectiveness of automated and manual identity provisioning, modification, and deprovisioning controls.
• Test the timeliness, completeness, and accuracy of account provisioning and deprovisioning activities.
• Evaluate periodic user access recertification processes and associated approval and completion evidence.
• Assess orphaned-account detection, identification, and remediation processes.
• Identify control weaknesses, manual dependencies, and opportunities to improve identity lifecycle governance and audit readiness.

Identity Governance, Role Mapping & Access Controls

• Evaluate enterprise Identity Governance and Administration (IGA) capabilities supporting DAF ICAM requirements.
• Map business processes, user populations, roles, identity attributes, access policies, and entitlements to applicable access governance controls.
• Assess Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) configurations and associated control effectiveness.
• Review identity governance workflows and access authorization processes to ensure alignment with established business and security requirements.
• Evaluate the completeness and accuracy of access entitlements and role assignments.
• Identify inappropriate, excessive, or outdated access privileges and recommend corrective actions.
• Support improvements to identity governance documentation, control traceability, and access review procedures.

Segregation of Duties & Access Recertification

• Document, evaluate, and test Segregation of Duties (SoD) rules and associated access restrictions.
• Assess preventive and detective SoD controls designed to identify and mitigate conflicting access privileges.
• Evaluate SoD exception approval processes, compensating controls, and periodic review procedures.
• Review access certification and recertification workflows to validate completeness, accuracy, and timeliness.
• Identify conflicting entitlements, excessive access privileges, and gaps in access governance.
• Document control deficiencies and recommend improvements to SoD enforcement, exception management, and access certification processes.
• Maintain supporting documentation and testing evidence for audit-readiness activities.

Privileged Access Governance & Evidence Validation

• Coordinate with external PAM organizations to evaluate privileged access governance and associated control evidence.
• Support evidence development for the Master User Record and elevated privilege assignments.
• Reconcile privileged-account inventories against authorized users, approved roles, and documented access requirements.
• Evaluate privileged access review processes, approval documentation, and supporting audit evidence.
• Identify stale privileges, unauthorized access assignments, and inconsistencies between privileged-account inventories and identity governance records.
• Assess the completeness and reliability of privileged access evidence supporting DAF ICAM control objectives.
• Collaborate with responsible Government PAM organizations to address identified control gaps without assuming operational ownership of PAM functions assigned to those organizations.

Okta & SailPoint IdentityIQ Control Assessment

• Evaluate technical configurations and identity governance workflows within Okta Identity Provider and SailPoint IdentityIQ.
• Analyze authentication, provisioning, deprovisioning, access certification, and identity governance configurations to determine their effectiveness in supporting established controls.
• Review identity integration points, role assignments, attributes, and entitlement management processes.
• Translate technical configurations and system-generated records into auditable control descriptions and supporting evidence.
• Identify configuration anomalies, control weaknesses, and opportunities to improve automated identity governance processes.
• Support development and maintenance of the D003 control traceability matrix using technical configuration details and supporting evidence from Okta and SailPoint IdentityIQ.
• Coordinate with technical administrators and system owners to validate control operation and resolve evidence gaps.

SOC 1 Audit Readiness & Control Documentation

• Support the DAF ICAM PMO in preparing identity governance and access management controls for SOC 1 audit-readiness assessments.
• Develop and maintain technical control narratives, process descriptions, control mappings, and supporting audit documentation.
• Evaluate control design and operating effectiveness through configuration reviews, evidence analysis, and control testing.
• Review SOC reports from upstream service providers, including Okta, AWS, and other applicable providers, to assess dependencies and impacts on the DAF ICAM control boundary.
• Identify relevant service-provider control considerations and document their relationship to DAF ICAM controls.
• Support development and maintenance of the D003 control traceability matrix.
• Prepare and organize audit evidence suitable for IPA review.
• Identify control deficiencies, evidence gaps, and manual dependencies that could affect audit readiness.
• Recommend improvements to control design, testing procedures, evidence collection, and documentation.
• Maintain evidence supporting Financial Improvement and Audit Remediation (FIAR) target metrics and reporting requirements.

Federal Cybersecurity Compliance & Risk Management

• Support evaluation of ICAM controls in accordance with applicable Department of Defense cybersecurity requirements and identity governance standards.
• Assess identity and access management controls supporting federal security, accountability, and audit-readiness objectives.
• Apply relevant Zero Trust principles to identity governance, authentication, authorization, and privileged access evaluation.
• Support compliance with applicable NIST security controls and federal cybersecurity requirements.
• Evaluate identity governance processes for security risks, inappropriate access, and weaknesses in control execution.
• Support identification, documentation, and tracking of control deficiencies and corrective actions.
• Apply applicable Controlled Unclassified Information (CUI) handling requirements when reviewing identity governance records and audit evidence.

Stakeholder Coordination, Reporting & Continuous Improvement

• Collaborate with DAF ICAM PMO personnel, Government stakeholders, PAM organizations, O&S teams, and enablement organizations.
• Coordinate technical evidence collection and control validation activities across multiple organizational stakeholders.
• Prepare control assessment summaries, audit-readiness reports, and technical findings for Government review.
• Communicate complex identity governance and access control concepts to technical and non-technical audiences.
• Identify anomalies, outdated privileges, manual process dependencies, and other control weaknesses.
• Recommend practical improvements to identity governance workflows, control documentation, and evidence collection processes.
• Support continuous improvement of ICAM control effectiveness and audit readiness while respecting established Government operational responsibilities.

Required Qualifications

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or a related field from an accredited college or university.
• Minimum of 6 years of professional experience in Identity Governance and Administration (IGA), Identity and Access Management (IAM) engineering, or ICAM controls evaluation.
• Direct hands-on configuration or administration experience with Okta Identity Provider (IdP) and SailPoint IdentityIQ.
• Demonstrated experience evaluating identity lifecycle management processes, including automated provisioning, deprovisioning, and access recertification workflows.
• Strong knowledge of enterprise identity governance, access authorization, role management, and entitlement administration.
• Experience developing, documenting, or testing Segregation of Duties (SoD) rules, exception approvals, and remediation processes.
• Familiarity with privileged access management concepts and technologies, including CyberArk or comparable platforms.
• Demonstrated ability to analyze technical identity configurations and translate findings into control narratives, testing documentation, and audit evidence.
• Experience assessing control completeness, timeliness, accuracy, and effectiveness.
• Ability to identify inappropriate access, stale privileges, orphaned accounts, and other identity governance control weaknesses.
• Strong understanding of the relationship between identity governance platforms, access controls, and audit-readiness requirements.
• Ability to collaborate effectively with PAM, O&S, enablement, and Government organizations without assuming operational ownership of externally managed functions.
• Strong analytical, problem-solving, technical documentation, and organizational skills.
• Excellent written and verbal communication skills.
• DoDM 8140.03 baseline certification appropriate to the position's assigned privileged access responsibilities.
• Ability to obtain and maintain the required Government position of trust/Public Trust determination, CAC, and NIPRNet access.

Preferred Qualifications

• Previous experience supporting SOC 1 or SSAE 18 audit engagements, particularly involving identity governance or federal financial-system controls.
• Experience supporting Department of Defense or Department of the Air Force cybersecurity, ICAM, or audit-readiness initiatives.
• Familiarity with Financial Improvement and Audit Remediation (FIAR) objectives, control documentation, and audit evidence requirements.
• Experience supporting Independent Public Accountant (IPA) reviews, control testing, or financial audit-readiness assessments.
• Experience evaluating service-provider SOC reports and documenting their impact on organizational control environments.
• Knowledge of Single Sign-On (SSO) and identity federation protocols, including SAML and OAuth 2.0.
• Understanding of Zero Trust Architecture principles and their application to enterprise identity governance.
• Previous experience supporting DoD Zero Trust, Mission Partner Environment ICAM, or data-federation initiatives.
• Experience with Salesforce, ServiceNow, or Governance, Risk, and Compliance (GRC) tools for control tracking, documentation, and performance reporting.
• Familiarity with NIST SP 800-171 and CUI handling requirements within identity governance environments.
• Experience supporting privileged access evidence collection, inventory reconciliation, or control validation.
• Experience identifying opportunities to automate identity governance controls and audit evidence collection.

Preferred Certifications

Candidates must possess the DoDM 8140.03 baseline certification appropriate to their assigned duties and privileged access responsibilities.

Additional relevant cybersecurity, identity management, or audit certifications are preferred, including:

• Certified Information Systems Security Professional (CISSP)
• Certified Information Systems Auditor (CISA)
• Certified Information Security Manager (CISM)
• CompTIA Security+
• Certified in Risk and Information Systems Control (CRISC)
• Certified Identity and Access Manager (CIAM)
• Relevant Okta or SailPoint IdentityIQ certifications
• Other relevant DoDM 8140.03-aligned cybersecurity, identity governance, or information systems audit certifications

Core Competencies

Successful candidates will demonstrate:

• Strong technical proficiency with Okta and SailPoint IdentityIQ
• Enterprise identity governance and lifecycle management expertise
• Ability to translate technical configurations into auditable control evidence
• Strong understanding of SOC 1 audit-readiness and control evaluation principles
• Analytical ability to identify access control weaknesses and evidence gaps
• Knowledge of Segregation of Duties and privileged access governance
• Attention to accuracy, traceability, and completeness of control documentation
• Understanding of federal cybersecurity and DoD identity management environments
• Ability to collaborate effectively across multiple Government and contractor organizations
• Strong technical writing, documentation, and reporting capabilities
• Effective communication with technical personnel, auditors, and Government stakeholders
• Ability to work independently within defined responsibilities and established Government control boundaries

Equal Employment Opportunity

Digital Global Connectors, LLC is an Equal Opportunity Employer. DGC provides equal employment opportunities to all qualified applicants and employees without regard to race, color, religion, sex, national origin, age, disability, protected veteran status, genetic information, or any other characteristic protected by applicable Federal, state, or local law.

Add a concise application call to actionClarify the location and work arrangement