About the Job

As a Senior SSO Architect & Technical Lead within our Identity & Access Management (IAM) organization, you will direct our Single Sign-On engineering squad and serve as the technical authority for enterprise authentication. In this role, you will maintain high availability for our core federation infrastructure, drive the migration to a modern workforce cloud identity platform, and partner across enterprise architecture and security teams to build a resilient, Zero Trust authentication ecosystem supporting over 70,000 corporate and clinical end-users nationwide.

Responsibilities

• Squad Leadership & Governance: Lead, mentor, and provide technical direction to the SSO engineering squad within an Agile/Scrum framework, representing SSO across Architecture Review Boards (ARB) and aligning roadmaps with enterprise security blueprints.
• Architecture Modernization: Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive multi-factor authentication (MFA), risk signals, and passwordless authentication (FIDO2, WebAuthn).
• Cloud Workforce Migration: Lead the active migration of workforce authentication to PingOne Workforce Cloud and evaluate fine-grained authorization solutions (ABAC/PBAC) to phase out legacy policy engines.
• High Availability & Operations: Maintain 99.99%+ operational availability for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID across dedicated endpoints, shared clinical kiosks, and virtual desktop infrastructure (Citrix VDI).
• Federation & Integration: Standardize and manage application onboarding across core clinical electronic health record (EHR) platforms and enterprise SaaS applications using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
• Security & Grant Remediation: Enforce enterprise standards ("configuration over customization"), eliminate insecure grant types (e.g., migrating ROPC flows to OAuth 2.0 Authorization Code with PKCE), and automate certificate lifecycle and token-signing key rotations.
• Cloud DevOps Automation: Drive infrastructure automation for identity services on Google Cloud Platform (GCP) utilizing Terraform, Kubernetes (GKE), Docker, and enterprise CI/CD pipelines.
• Ecosystem Collaboration: Partner with Microsoft/M365 infrastructure teams to optimize Primary Refresh Token (PRT) evaluation, Conditional Access policies, and long-term hybrid cloud identity roadmaps.

Qualifications

Minimum Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent practical experience.
• 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
• 2+ years of technical leadership experience leading engineering teams, conducting code/architecture reviews, and partnering with enterprise architecture groups.
• Deep hands-on expertise in the Ping Identity product suite, including PingFederate, PingDirectory, PingID, PingOne Workforce Cloud, and PingOne DaVinci for identity orchestration.
• Expert mastery of modern identity protocols and token standards: SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM.
• Hands-on DevOps experience with Google Cloud Platform (GCP), Terraform (IaC), containerization (Docker, GKE), CI/CD pipelines, and scripting languages (Python, Bash, or PowerShell).

Preferred Qualifications

• Experience designing and maintaining Tier-0 high-availability identity systems within large-scale, highly regulated healthcare environments subject to HIPAA compliance.
• Familiarity with fine-grained authorization concepts (ABAC/PBAC) and externalized policy engines (such as PingAuthorize) to replace legacy systems.
• Strong working knowledge of Microsoft Entra ID (Azure AD), Microsoft 365 hybrid federation, Conditional Access, and Intune integration.
• Experience implementing session policies, Single Logout (SLO), and specialized authentication flows for shared clinical endpoints and virtualized desktop environments (VDI).
• Industry certifications such as:
• Ping Identity Certified Professional / Architect
• Google Cloud Certified Professional Cloud DevOps Engineer or Cloud Security Engineer
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) or Cybersecurity Architect Expert (SC-100)
• Certified Information Systems Security Professional (CISSP) or Certified Identity and Access Manager (CIAM)

Apply now