Active Directory Iam Engineer Architect Entra

THERE ARE NOW TWO OPEN POSITIONS THEY WANT TO FILL THIS WEEK!!! We are hiring a Senior (10+ Years) IAM Engineer to design, build and secure identity for both our employees and our customers. You will own how people sign in, what they can access, and how our applications and APIs trust each other. This is a hands-on engineering role, not an SSO configuration role. You will work at the protocol level with OAuth 2.0 and OpenID Connect, lead our move to phishing-resistant MFA, and shape identity architecture across workforce IAM and customer identity (CIAM). **** THIS IS A SENIOR ACTIVE DIRECTORY ENGINEER WITH ABOVE AVAERAGE EXPERIENCE WORKING WITH IAM AND IN PARTICULAR ONBOARDING AND CIAM. THIS POSITION IS FOR AN IAM SPECIALIST BUT IT IS NOT ALL THEY WILL DO, THERE IS AN ACTIVE DIRECTORY COMPONET AS WELL. CANDIDATES MUST SIT IN MANASSAS, VA OR WILMINGTON, DE AT LEAST A COUPLE TIMES A WEEK. ****CANDIDATES MUST HAVE GOOD TENURE AND/OR LONG PROJECTS. CANDIDATES WITH VERY RECENT LOCAL PROJECTS HIGHLY NEEDED. NO RELOCATION

*** All submittals must Include:
1. Driver's license or State ID
2. Link to the candidates LinkedIn account.
3. Below submittal Format

*** Experience required on a resume and for submittal:
1. How many years working with: Active Directory/IAM Engineer
2. How many years working with: IAM
3. How many years working with: Dedicated CIAM platforms, such as Auth0, Okta Customer Identity, Microsoft Entra External ID, Ping or ForgeRock
4. How many years working with: Experience with both workforce IAM and customer-facing identity, and a clear view of how their goals
5. How many years working with: Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect: grant types, token types and their intended uses, token validation

We are hiring a Senior IAM Engineer to design, build and secure identity for both our employees and our customers. You will own how people sign in, what they can access, and how our applications and APIs trust each other.
This is a hands-on engineering role, not an SSO configuration role. You will work at the protocol level with OAuth 2.0 and OpenID Connect, lead our move to phishing-resistant MFA, and shape identity architecture across workforce IAM and customer identity (CIAM).

Key responsibilities
Application and API identity
Design and implement OAuth 2.0 and OpenID Connect flows for web, mobile, single-page and service-to-service applications.
Define how applications and APIs request, validate and use tokens, including scopes, claims, audiences, lifetimes and revocation.
Review application teams' identity integrations and correct insecure token handling patterns before release.

Authentication and MFA
Lead the rollout of phishing-resistant MFA, including FIDO2/WebAuthn passkeys and hardware security keys such as YubiKeys.
Plan the migration away from weaker factors (SMS, email codes, push approval) for privileged and high-risk users first.
Design enrollment, recovery and lost-device processes that stay secure without overwhelming the help desk.

Workforce identity
Own employee and contractor identity across joiner, mover and leaver processes.
Implement SSO, conditional access, role-based access and privileged access controls.
Support access reviews and audit evidence for SOC 2, ISO 27001 or similar frameworks.

Customer identity (CIAM)
Design customer sign-up, sign-in, social login and passwordless experiences that scale to large user populations.
Balance account security (account takeover protection, bot defense, step-up authentication) with conversion and user experience.
Support privacy and consent requirements such as GDPR and CCPA in customer identity flows.

Architecture and collaboration
Set identity standards and reference patterns that engineering teams can adopt.
Partner with security, application, product and compliance teams, and explain identity trade-offs to non-specialists.
Investigate and help respond to identity-related incidents.

Required qualifications
10+ years in identity and access management, security engineering or a closely related role, with at least 3 years hands-on in IAM.
Deep, protocol-level understanding of OAuth 2.0 and OpenID Connect: grant types, token types and their intended uses, token validation, and common implementation mistakes.
Hands-on experience deploying or engineering phishing-resistant authentication with FIDO2/WebAuthn, passkeys or hardware security keys, and the ability to explain why these methods resist phishing.
Experience with both workforce IAM and customer-facing identity, and a clear view of how their goals, risks and design priorities differ.
Working knowledge of SAML 2.0 and federation.
Hands-on experience with at least one major identity platform, such as Microsoft Entra ID, Okta, Ping Identity or Auth0.
Scripting or development skills (for example Python, PowerShell, JavaScript or C#) for automation and integration work.
Ability to explain technical identity concepts clearly to engineers, auditors and business stakeholders.

Preferred qualifications
Experience with dedicated CIAM platforms, such as Auth0, Okta Customer Identity, Microsoft Entra External ID, Ping or ForgeRock.
Familiarity with newer OAuth security practices, such as PKCE, token binding approaches (DPoP or mTLS), and the OAuth 2.0 Security Best Current Practice.
Experience with identity governance and administration (IGA) and privileged access management (PAM) tools, such as SailPoint, Saviynt or CyberArk.
Experience with SCIM provisioning and API gateway authorization.
Experience in a regulated industry, such as financial services, healthcare or legal.
Relevant certifications, such as CISSP, Microsoft SC-300, Okta Certified Professional or Consultant, or a CIAM vendor certification.