GovCIO is currently hiring an IAM Architect specializing in Identity Resolution and Person Matching to design and lead enterprise capabilities that establish a single, trusted, authoritative identity for every individual across mission and business systems at the Department of Veterans Affairs. This role owns the architecture for matching, deduplicating, and linking person records - combining traditional Identity, Credential, and Access Management (ICAM) engineering with deterministic and probabilistic identity-matching disciplines to reduce duplicate identities, prevent identity fraud, and improve data quality across the enterprise. This is a fully remote position located within the United States.
Please note: The contract has not been awarded; this position remains unfunded and is contingent upon the award of the contract.
Responsibilities
- Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores.
- Design deterministic and probabilistic record-linkage strategies - including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching - to accurately resolve person identities across disparate and inconsistently formatted data sources.
- Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.
- Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.
- Design and implement Zero Trust identity principles across enterprise network and application boundaries.
- Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).
- Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.
- Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.
- Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.
- Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.
- Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines.
Qualifications
Required Skills & Experience
- Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience). •
- 12+ years of experience in identity and access management engineering/architecture.
- 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.
- Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.
- Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.
- Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).
- One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications.
Clearance Required: Must be able to obtain and maintain a suitability/public trust clearance. Preferred Skills & Experience
- Experience with entity-resolution or Master Person Index (MPI).
- Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.
- Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).
- Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.
- Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.
- Master's degree in a related technical field.
Posted Salary Range
USD $155,000.00 - USD $175,000.00 /Yr.
- Architect and lead enterprise identity resolution and person-matching capabilities that establish and maintain a single authoritative, deduplicated identity record (a “golden record”) across mission, HR, credentialing, and mission-partner data stores.
- Design deterministic and probabilistic record-linkage strategies - including fuzzy matching, weighted attribute scoring, and machine-learning-assisted matching - to accurately resolve person identities across disparate and inconsistently formatted data sources.
- Own the architecture, integration, and lifecycle management of a Master Person Index (MPI) / Enterprise Identity Index, including match/merge rules, survivorship logic, and false-positive/false-negative tuning.
- Architect identity lifecycle management, user provisioning/de-provisioning workflows, and privileged access controls in coordination with the broader ICAM program.
- Design and implement Zero Trust identity principles across enterprise network and application boundaries.
- Lead federated identity, directory services, authentication, and SSO architecture (SAML, OAuth 2.0, OIDC, SCIM, Active Directory/LDAP).
- Partner with data governance, privacy, and mission stakeholders to define data-quality standards, matching thresholds, and audit/traceability requirements for identity data.
- Develop technical architecture diagrams, data flows, matching-logic documentation, and compliance artifacts; brief findings and recommendations to government technical leads and stakeholders.
- Act as a technical escalation point and mentor for IAM Engineers, providing architectural oversight and code reviews for automation scripts.
- Collaborate with cross-functional teams to define requirements, troubleshoot issues, and deliver innovative solutions aligned with organizational objectives.
- Conduct root-cause analysis of identity-matching errors (duplicate identities, mismatches, orphaned records) and drive continuous improvement of matching algorithms and data pipelines.
Required Skills & Experience
- Bachelor's degree in Computer Science, Information Systems, or a related field, and 15 years of experience engineering/architecture (or commensurate combination of education and experience). •
- 12+ years of experience in identity and access management engineering/architecture.
- 8+ years in Cybersecurity with at least 5 years dedicated to IAM Architecture in large-scale environments.
- Demonstrated, hands-on experience designing and implementing person identity matching / identity resolution capabilities at enterprise scale, including deterministic and probabilistic record linkage.
- Deep technical understanding of federated identity protocols, including SAML, OAuth 2.0, OIDC, SCIM, and Active Directory/LDAP architecture.
- Working knowledge of NIST SP 800-63 (Digital Identity Guidelines: 800-63A/B/C) and NIST SP 800-207 (Zero Trust Architecture).
- One or more certifications: CISSP, Security+ CE, CASP+, or vendor-specific identity certifications.
Clearance Required: Must be able to obtain and maintain a suitability/public trust clearance. Preferred Skills & Experience
- Experience with entity-resolution or Master Person Index (MPI).
- Direct experience with enterprise IAM tools such as SailPoint, Okta, Microsoft Entra ID, Ping Identity, or DigiCert.
- Experience supporting a federal identity-management or person-matching program (e.g., DHS, USCIS, VA, SSA, or similar agency).
- Knowledge of data governance frameworks and their integration with identity/ICAM solutions to enforce data-level access controls.
- Advanced knowledge of RESTful API authorization protocols and secure data-exchange gateways.
- Master's degree in a related technical field.
