Applications for this position will be accepted through 11/15/26
Koniag IT Systems, LLC a Koniag Government Services company, is seeking a CDO-L Study Lead Engineer with a Secret security clearance to support KITS and our government customer. The position is remote.
Koniag IT Systems, LLC a Koniag Government Services company, is seeking an experienced CDO-L Study Lead Engineer to support the Department of the Air Force (DAF) in advancing its enterprise Identity, Credential, and Access Management (ICAM) capabilities. This position will lead a focused, technically grounded study effort under Task Order 0003, System Enhancement Studies, with a primary focus on extending secure ICAM capabilities into Contested, Degraded, and Operationally Limited (CDO-L) environments. The ideal candidate is a technically seasoned engineer and collaborative leader with deep experience in Defense ICAM architectures, Zero Trust frameworks, and disconnected/edge identity solutions who can translate complex operational requirements into actionable architectures and implementation roadmaps.
*This study will run 120 days. All personnel assigned to CDO-L study activities must hold a final Secret security clearance.
The CDO-L Study Lead Engineer will serve as the primary technical authority for Study 1 of the DAF ICAM System Enhancement Studies effort, leading the analysis, architecture development, and documentation required to produce a decision-ready Technical Study Report within 45 calendar days of Task Order award. The Lead Engineer will coordinate closely with the Program Manager, Systems Architecture Team, Licensing/Cost Analyst, and Government stakeholders to ensure all study outputs are technically sound, operationally grounded, and fully traceable to Performance Work Statement (PWS) Section 4.1 requirements.
Principal responsibilities will include but are not limited to:
Lead the structured review of Government-provided CDO-L requirements published at the DoD Enterprise ICAM IL5 and IL6 DDIL reference site, cataloging each requirement by operational condition (denied, degraded, intermittent, and limited bandwidth) and mapping them against existing DAF ICAM solution components including Okta Universal Directory (UD), Okta Identity Provider (IdP), and SailPoint IdentityIQ (IIQ).
Conduct a gap analysis between current DAF ICAM capabilities and CDO-L operational demands to serve as the foundation for all architectural recommendations.
Evaluate existing approved ICAM solutions across comparable Federal Defense programs and assess their applicability to DAF CDO-L requirements, prioritizing solutions that extend existing approved capabilities rather than introducing net-new vendor stacks.
Lead the architectural analysis of options for on-premises replication or caching of identity and access data at disconnected nodes, evaluating a tiered edge identity broker model across three operational states: Connected, Degraded/Limited Bandwidth, and Denied.
Assess and document synchronization schedules, minimum connectivity requirements, degraded-mode operating parameters, and cache staleness thresholds for each operational state.
Evaluate specific DAF ICAM-aligned edge components including Okta Access Gateway (OAG) and Tactical Identity Bridge Appliance (TIBA) for their suitability in extending ICAM operations to the tactical edge.
Assess how existing SailPoint IIQ governance workflows can be mirrored at the edge to maintain entitlement integrity during disconnected operations.
Document tradeoffs between full replication, selective caching, and read-only policy mirroring, and provide a recommended approach with clear technical rationale grounded in DAF operational requirements.
Develop recommendations for emergency "break-glass" access provisioning in fully offline or denied-state conditions, including governance controls, immutable local audit logging, and automated revocation and re-synchronization workflows.
Evaluate approaches for PKI certificate validation…