Senior Cybersecurity Engineer, Identity & Access Management

CHAOS Industries is redefining modern defense with a multi-product portfolio that gives the ultimate advantage—domain dominance. The company's products are powered by Coherent Distributed Networks (CDN™), empowering warfighters, commercial air operators, and border protection teams to act faster, adapt rapidly, and stay ahead of evolving threats.
CHAOS Industries was founded in 2022 and has raised a total of $1 billion in funding from leading investors, including 8VC, Accel, and Valor Equity Partners. The company is headquartered in Los Angeles, with offices in Washington, D.C., San Francisco, San Diego, and London. For more information, please visit www.chaosinc.com.
Role Overview:
CHAOS is seeking a Senior Cybersecurity Engineer, Identity & Access Management to own the identity layer that protects our Controlled Unclassified Information and export-controlled technical data. This role’s primary goal is to make our IdP, IAM, PAM, PIM, and Secrets Management platforms work as one coherent system that meets CMMC Level 2, NIST SP 800-171, DFARS 252.204-7012, and ITAR, and that people can actually use.
You'll work alongside security operations, IT, HR, and compliance as the person who turns policy into working access controls, from onboarding through offboarding. This is a hands-on role with real influence over where our identity architecture goes next.
Responsibilities:
Design, build, and maintain identity architecture and role-based access control (RBAC) across cloud and on-premises directory services.
Own and automate the IAM portion of the joiner, mover, and leaver (JML) process across identity, directory, cloud, and secrets platforms, so that access is provisioned at hire, adjusted when roles change, and revoked promptly at departure. You coordinate with human resources and IT, who own the employee record and device steps.
Design and tune authentication policies, conditional access, phishing-resistant multi-factor authentication (MFA), and device compliance requirements.
Build identity-focused detections and threat hunts in the company's SIEM, EDR, and SOAR tools, and support the security operations center (SOC) during identity-related investigations.
Operate and mature a tiered administrative model, including privileged access workstations (PAWs) and dedicated administrator accounts.
Administer privileged identity management for just-in-time role activation and privileged access reviews.
Administer the enterprise password and secrets management platform, including role-based enforcement policies, vault structure, SSO integration, and vaulting of privileged and shared credentials.
Manage cloud infrastructure IAM, including role assignments, service identities, and workload identity federation.
Integrate software as a service (SaaS) and internal applications with single sign-on (SSO) through SAML and OpenID Connect, and with SCIM for automated provisioning.
Maintain Active Directory security, including account lifecycle hygiene, service accounts and group Managed Service Accounts (gMSAs), and ongoing attack path analysis.
Run periodic access reviews and produce assessment evidence for the NIST SP 800-171 Access Control (AC) and Identification and Authentication (IA) families.
Write and maintain IAM policies, standards, and procedures.
Minimum Requirements:
Bachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field with 5+ years of progressively responsible cybersecurity engineering experience, or a Masters degree with 3+ years of relevant experience.
At least two years of experience focused on IAM.
Hands-on experience administering IdP in a production environment.
Hands-on experience administering Entra ID or Active Directory.
Experience running the provisioning, access change, and deprovisioning steps of a JML process.
Experience designing authentication policies and deploying phishing-resistant MFA across an organization.
Working knowledge of Kerberos, NTLM, LDAP,