AWS Cloud Infrastructure Engineer (Keycloak Specialty)

📋 Description

• • Design and maintain the identity architecture using Keycloak for the Case Management Modernization (CMM) Program supporting the Administrative Office of the U.S. Courts.
• • Implement federated identity and single sign-on (SSO) solutions using SAML, OAuth2.0, and OIDC protocols across cloud-based applications.
• • Collaborate with Cloud and Security Architects to enforce Zero Trust Architecture (ZTA) principles across microservices and APIs in an AWS environment.
• • Configure and maintain directory services and identity providers including AWS Cognito, AWS IAM Identity Center, Azure AD, IBM Verify, and Keycloak.
• • Integrate Keycloak as a broker Identity Provider (IdP) to federate upstream enterprise IdPs and issue downstream OIDC tokens to applications.
• • Design identity solutions and support compliance assessments aligned with FISMA, NIST 800-63, and FedRAMP security controls.
• • Develop and document identity lifecycle management processes including provisioning, deprovisioning, and periodic access reviews.
• • Implement least privilege roles and groups for both privileged and non-privileged users in a FedRAMP High system environment.
• • Define workflows, rules, and policies within ICAM tools, particularly Keycloak and IBM Verify.
• • Conduct access audits, user entitlement reviews, and anomaly detection to ensure compliance with least-privilege requirements.
• • Provide subject matter expertise in identity federation, PKI, certificate management, and secure API authorization.
• • Design logging, monitoring, and auditing strategies for authentication and authorization events integrated with AWS CloudTrail and other event logs.
• • Implement storage-level and microservice-level authentication and authorization mechanisms.
• • Support the Authority to Operate (ATO) process by documenting security control implementations, maintaining architecture diagrams in Visio, and providing compliance evidence.
• • Participate in design sessions and collaborate closely with the security lead to align identity solutions with overall system architecture.
• • Embed ICAM policies into CI/CD pipelines and Infrastructure-as-Code (IaC) templates in partnership with DevSecOps teams.
• • Lead penetration testing activities and review architecture diagrams produced by cross-functional teams.
• • Independently lead the design and implementation of vulnerability management processes related to identity systems.
• • Lead and direct engineering teams to deliver identity and access management solutions.
• • Deliver architecture diagrams depicting identity flows, federation points, and integration with AWS and CMM systems.
• • Produce access control documentation including RBAC models and credential management workflows.
• • Generate compliance verification reports aligned to NIST 800-63, FedRAMP, and FISMA standards.
• • Deliver Zero Trust Implementation Artifacts verifying ZTA enforcement across system components.
• • Ensure 100% of CMM applications are integrated with SSO and MFA.
• • Achieve zero unauthorized access incidents attributable to configuration errors.
• • Maintain 100% compliance with NIST and FedRAMP ICAM control requirements.
• • Reduce account provisioning time by at least 30% through automation.
• • Utilize tools including Keycloak, Okta, SailPoint, CyberArk, HashiCorp Vault, AWS IAM, KMS, CloudTrail, Lambda, Splunk, Jira, Confluence, SharePoint, and MS Teams.
• • Work in a remote capacity with less than 10% travel required.
• • Operate within a 40-hour weekly schedule.