W2 Only (No C2C) :: Dallas, TX (Hybrid, 3+ Days) :: Senior Identity Security Engineer || G.C / U.S.C

Senior Identity Security Engineer (6–9 years) || G.C / U.S.C

Dallas, TX (Hybrid, 3+ Days)

12+Months

W2 Only (No C2C)

Summary:
Seeking a hands-on Senior Identity Security Engineer to design, implement, and operate next-generation identity-centric security capabilities aligned to Zero Trust. You will engineer and integrate identity threat protection, attack path analysis, modern authentication, and policy-based access control (PBAC) across enterprise platforms and applications. This role partners with cybersecurity, infrastructure, engineering, and product teams to reduce identity risk, improve resilience, and enhance user access experiences.

Key Responsibilities:
- Engineering and Platform Operations
- Implement, integrate, and maintain identity security platforms including Entra ID (Azure AD), PlainID (PBAC), Sgnl.ai, and CrowdStrike Identity Protection.
- Build integrations with enterprise apps and infrastructure using APIs/SDKs (REST/Graph), SCIM, SAML/OIDC/OAuth2.
- Automate provisioning, policy deployment, and configuration management using PowerShell, Python, Terraform/Bicep/ARM, and CI/CD.

- Identity Threat Protection and Attack Path Analysis
- Execute attack path mapping and remediation for identity-based risks across Entra ID/AD and hybrid environments.
- Tune and operationalize identity threat detection, risk scoring, and identity-driven attack containment; integrate signals with SIEM/SOAR and EDR.
- Develop playbooks, runbooks, and detection-as-code for identity-centric use cases.

- Authentication and Access Modernization
- Implement strong and adaptive authentication (MFA, FIDO2/WebAuthn/passkeys, device trust, conditional access).
- Partner with app teams to enable identity-aware authorization patterns and PBAC via PlainID (policy modeling, attribute onboarding, PDP/PEP integration).
- Enhance authenticator user experience and reduce friction while meeting security/compliance goals.

- Behavioral Analytics and Risk-Based Controls
- Integrate UEBA/behavioral biometrics and identity risk signals into authentication and access decisions.
- Contribute to continuous verification controls aligned with Zero Trust.

- Delivery and Collaboration
- Translate requirements into technical designs, test plans, and deployment guides; produce high-quality documentation.
- Collaborate with vendors and internal teams; support change management, incident response, and on-call rotations for identity services.
- Track KPIs/KRIs (e.g., MTTD/MTTR for identity incidents, policy coverage, misconfiguration reduction).

Required Qualifications:
- 6–9 years of cybersecurity experience, with 4+ years focused on IAM/identity security engineering.
- Hands-on expertise with:
- Entra ID (Azure AD): Conditional Access, Identity Protection, SSO, MFA, identity governance, federation (SAML/OIDC/OAuth2), SCIM.
- At least two of: PlainID (PBAC), Sgnl.ai, CrowdStrike Identity Protection.
- Practical experience with Zero Trust and ITDR concepts; familiarity with identity-focused attack techniques and mitigations (e.g., privilege escalation paths, lateral movement, service principal/agent abuse).
- Experience conducting attack path analysis and remediation in AD/Entra ID (e.g., misconfigurations, excessive entitlements).
- Strong scripting/automation skills (PowerShell, Python) and infrastructure-as-code (Terraform/Bicep/ARM).
- Integration experience with SIEM/SOAR (e.g., Microsoft Sentinel, Splunk) and EDR (e.g., CrowdStrike).
- Solid understanding of authorization models (RBAC/ABAC/PBAC) and policy lifecycle management.
- Excellent communication, documentation, and stakeholder collaboration skills.

Preferred Qualifications:
- Experience with FIDO2/WebAuthn, passkeys, certificate-based auth, device trust, and adaptive access.
- Familiarity with UEBA/behavioral analytics and risk-based authentication tuning.
- Knowledge of AD/Azure AD security hardening, Privileged Access Management (PAM), and Just-in-Time/Just-Enough Access (JIT/JEA).
- Exposure to containerized and cloud-native app integrations; API gateways and policy enforcement points.
- Certifications: SC-300, SC-100, AZ-500, CISSP, GIAC (e.g., GCIA, GCED) or equivalent experience.
- Understanding of NIST SP 800-207 (Zero Trust), MITRE ATT&CK for Enterprise/Defend, and relevant regulatory/compliance requirements.

Education:
- Bachelor’s degree in Computer Science, Information Security, Engineering, or equivalent practical experience.