DAF365 JML Lead Engineer (Study 3)

Applications for this position will be accepted through 11/15/26 Koniag IT Systems, LLC a Koniag Government Services company, is seeking a DAF365 JML Lead Engineer (Study 3) with a Secret security clearance to support KITS and our government customer. The position is remote.

Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits and tuition reimbursement. Koniag IT Systems, LLC , a Koniag Government Services company, is seeking an experienced DAF365 JML Lead Engineer to support the Department of the Air Force (DAF) in advancing its enterprise Identity, Credential, and Access Management (ICAM) capabilities.

This position will lead a comprehensive technical study effort under Task Order 0003, System Enhancement Studies, with a primary focus on defining the architecture, workflows, and implementation roadmap required to transform the DAF365 Joiner, Mover, Leaver (JML) process from a legacy, manual, script-based identity creation model into a robust, automated, DAF ICAM-driven provisioning framework. The ideal candidate is a technically seasoned identity engineer and collaborative leader with deep hands-on experience designing attribute-based provisioning workflows in Okta Universal Directory environments integrated with Microsoft Entra ID who can translate complex operational requirements into actionable, decision-ready technical architectures and phased implementation roadmaps.

Note, this is a 120-day study. All personnel assigned to DAF365 JML study activities must hold a final Secret security clearance. This position is Remote.

The DAF365 JML Lead Engineer will serve as the primary technical authority for Study 3 of the DAF ICAM System Enhancement Studies effort, leading the analysis, workflow design, architecture development, and documentation required to produce a decision-ready Technical Study Report within 90 calendar days of Task Order award.The Lead Engineer will coordinate closely with the Program Manager, Identity Architects, Licensing/Cost Analyst, Systems Analyst, and Government stakeholders to ensure all study outputs are technically precise, operationally grounded, and fully traceable to Performance Work Statement (PWS) Section 4.3 requirements.

The study will progress through five tightly scoped analytical workstreams, each corresponding to a PWS requirement, and culminate in a phased implementation roadmap with a ROM cost estimate suitable for informing a subsequent implementation Task Order.

Principal responsibilities will include but are not limited to:

Lead the comprehensive mapping of identity attributes currently flowing from DAF authoritative Human Resources (HR) sources—including Military Personnel Data System (MILPDS) for military personnel and Defense Civilian Personnel Data System (DCPDS) for civilian employees—into the Okta Universal Directory (UD), exposing attribute quality deficiencies, naming convention inconsistencies, and data gaps that prevent reliable Attribute-Based Access Control (ABAC) rule execution downstream.

Define a formal attribute schema specifying required fields, accepted value formats, data type constraints, and source-of-record assignments for each attribute class relevant to DAF365 provisioning, including rank, unit, Air Force Specialty Code (AFSC), clearance level, and duty status.

Document explicit sanitization and normalization rules defining how incoming raw HR data is transformed into clean, policy-actionable attributes within the Okta UD before any downstream provisioning event is triggered.

Assess current data pipeline quality and identify where transformation logic must reside—within Okta Workflows, an upstream extract-transform-load (ETL) process, or a combination of both—and specify the controls that prevent attribute errors from propagating to incorrect license assignments, improper group memberships, and access control failures requiring manual remediation.

Design a target-state technical architecture that routes all DAF365 identity management actions directly through DAF ICAM, removing the dependency on legacy intermediary systems such as Area52 Active Directory (AD), decoupling reliance on physical and logical base locations, and advancing the DAF toward full provisioning automation capability.

Document the current-state provisioning path, identify integration touchpoints where legacy systems currently insert latency and manual steps, and define the future-state flow in which Okta serves as the authoritative orchestration layer pushing identity events directly into Microsoft Entra ID via System for Cross-domain Identity Management (SCIM) provisioning and Microsoft Graph API.

Specify the role of Okta's on-premises provisioning agents as a bridging mechanism for environments where on-premises Active Directory dependencies remain for legacy application authentication, enabling cloud-native orchestration to extend into legacy domain environments without requiring those environments to be modernized as a precondition of JML automation.

Document specific Entra ID configuration requirements, including tenant structure, domain federation settings, and Okta application integration parameters, required to support direct ICAM-driven provisioning, leveraging current Entra ID architecture guidance to ensure alignment with current platform capabilities and near-term feature availability.

Define the end-to-end technical architecture for three discrete JML event types within the DAF365 environment:

Joiner: Specify how Okta detects a new identity record in the authoritative HR source, creates a UD profile, applies ABAC rules to determine group membership, and pushes a provisioned identity into Entra ID with the correct DAF365 license tier, mailbox configuration, and group assignments before the individual arrives at their duty station. Define attribute thresholds that trigger Joiner events, the sequence of provisioning actions, and error handling behavior when required attributes are missing or malformed.

Mover: Address the full range of organizational change events that alter a DAF member's access requirements, including Permanent Change of Station (PCS), promotion, role change, Temporary Duty (TDY), and deployment. For each event type, specify which HR system attribute change serves as the trigger, which Okta group memberships are revoked and granted, and which downstream DAF365 actions result. Define workflow routing logic, approver roles, and escalation timelines for elevated privilege changes, and specify how hardcoded expiration dates are set and enforced for temporary access grants to prevent TDY-based access from persisting beyond the operational requirement.

Leaver: Specify the cascading revocation sequence initiated upon receipt of a separation or termination date from the HR system, including Okta disablement of the primary identity to terminate active authentication sessions across all federated applications; Entra ID session token revocation to force immediate logouts on desktop and mobile clients; DAF365 license reclamation to return the license to the enterprise pool; and automated mailbox handling to convert the O365 mailbox to a shared mailbox or place it on litigation hold in compliance with DoD data retention policy.

Specify which automation tooling—such as Okta Workflows or Microsoft Power Automate—executes each step and document expected execution latency for each revocation action.

Document the procedural framework enabling base-level administrators to provision DAF365 accounts and network access directly through DAF ICAM interfaces without requiring elevated enterprise-level access or manual intervention from centralized identity teams.

Define the role-based access model for base-level administrators within the DAF ICAM toolset, specifying which provisioning actions are delegable, what approval gates apply, and how audit trails are generated for each action.

Document administrator-facing workflows within Okta and SailPoint IIQ interfaces, providing step-by-step procedural guidance that base-level administrators can follow to execute Joiner, Mover, and Leaver actions within their delegated authority, and specify any configuration changes required to expose base-level provisioning capabilities.

Quantify, based on current manual provisioning timelines, the projected reduction in provisioning latency achievable through the base-level administrator delegation model.

Coordinate with the Program Manager and Licensing/Cost Analyst to synthesize study findings into a phased implementation roadmap and ROM cost estimate, sequencing implementation activities beginning with attribute schema formalization and data pipeline remediation as the foundational first phase, followed by direct Entra ID integration architecture, JML group management workflows, and base-level administrator delegation model in dependency-sequenced order.

Consolidate all study outputs into the DAF365 JML Transformation Framework Technical Study Report (CDRL B010), ensuring each section maps directly to PWS Section 4.3 requirements and presents a technically precise, decision-ready product suitable for informing a future implementation Task Order.

Submit a draft report to the Government Program Manager and COR in advance of the final 90-calendar-day delivery date to allow sufficient time for Government review and revision cycles within the 120-day Period of Performance.

Present study findings to the Government Program Manager and Contracting Officer's Representative (COR) as required throughout the study period.

Verify that all assigned personnel hold the required security clearances prior to engagement and notify the Government immediately of any clearance status changes.

Education and Experience:

Required:

Bachelor's degree in Computer Science, Computer Engineering, Information Systems, Cybersecurity, or a related technical field from an accredited college or university.

7+ years of experience in identity and access management engineering, enterprise architecture, or identity lifecycle management within Defense or Federal government IT environments.

Demonstrated hands-on experience designing attribute-based provisioning workflows in Okta Universal Directory environments integrated with Microsoft Entra ID or Azure Active Directory.

Experience designing or analyzing Joiner, Mover, Leaver identity lifecycle management processes for enterprise populations in DoD or Federal environments.

Experience with Microsoft Entra ID, including SCIM provisioning, Microsoft Graph API integration, tenant configuration, and domain federation settings.

Active Secret security clearance (final adjudication required prior to assignment).

Preferred:

Master's degree in a related technical field.

10+ years of experience in Defense or Federal ICAM, identity lifecycle engineering, or enterprise identity architecture.

Experience supporting DAF, Air Force, Space Force, or other DoD component ICAM, Microsoft 365, or enterprise identity modernization programs.

Direct experience with DAF365, Air Force identity management systems, or legacy identity provisioning processes including AFID-based identity creation.

Familiarity with MILPDS, DCPDS, or other DoD authoritative HR data systems and their integration with enterprise identity platforms.

Required Skills and Competencies:

Deep technical knowledge of Okta platform architecture, including Universal Directory schema design, attribute mapping, ABAC rule configuration, Okta Workflows, provisioning agent deployment, and application integration for enterprise JML automation.

Proficiency in Microsoft Entra ID architecture, including SCIM provisioning configuration, Microsoft Graph API integration, tenant structure, domain federation, and Entra ID group and license management.

Strong understanding of identity lifecycle management processes—Joiner, Mover, and Leaver—and the technical event triggers,