IAM Architect

GovCIO is currently hiring an IAM Architect specializing in Identity Resolution and Person Matching to design and lead enterprise capabilities that establish a single, trusted, authoritative identity for every individual across mission and business systems at the Department of Veterans Affairs. This role owns the architecture for matching, deduplicating, and linking person records — combining traditional Identity, Credential, and Access Management (ICAM) engineering with deterministic and probabilistic identity-matching disciplines to reduce duplicate identities, prevent identity fraud, and improve data quality across the enterprise. This is a fully remote position located within the United States.

Please note: The contract has not been awarded;  this position remains unfunded and is contingent upon the award of the contract. 

Responsibilities

• Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores.

• Design deterministic and probabilistic record-linkage strategies — including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching — to accurately resolve person identities across disparate and inconsistently formatted data sources.

• Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.

• Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.

• Design and implement Zero Trust identity principles across enterprise network and application boundaries.

• Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).

• Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.

• Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.

• Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.

• Collaboratewith cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizationalobjectives.

• Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines.

Qualifications

Required Skills & Experience

• Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience).
  • • 12+ years of experience in identity and access management engineering/architecture.

• 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.

• Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.

• Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.

• Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).

• One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications.

Clearance Required: Must be able to obtain and maintain a suitability/public trust clearance.

Preferred Skills & Experience

• Experience with entity-resolution or Master Person Index (MPI).

• Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.

• Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).

• Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.

• Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.

• Master's degree in a related technical field.

Posted Salary Range

USD $155,000.00 - USD $175,000.00 /Yr.