Q
Senior SSO Architect & Team Lead
Quantix
- 🇺🇸 United States
- Remote
- Staff / Principal
- 8 hours ago
- Agile
- Scrum
- IAM
- Oracle
- M365
- Conditional Access
- Citrix
- Epic
- Cerner
- SAML
- OpenID Connect
- OIDC
- DaVinci
- WebAuthn
- GCP
- Devops
- IaC
- Terraform
- CI/CD
- GKE
- HIPAA
- Ping Identity
- ABAC
- JWT
- SCIM
- Azure AD
- Intune
- Kubernetes
- Docker
- Jenkins
- GitLab CI
- REST API
- Python
- PowerShell
- Bash
- CISSP
8 hours ago
LOCATION: Remote
TYPE: Contract
LENGTH: Thru the end of 2027+ extensions
RATE: Up to $80/hr W2
Key Responsibilities
1. Team Leadership & Architecture Governance
- Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
- Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
- Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).
- Microsoft Ecosystem Collaboration: Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.
- Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID.
- Workforce & CIAM Integrations: Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
- Application Federation: Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
- Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.
- Cloud Workforce Migration: Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
- Standards Enforcement: Champion and enforce DaVita SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
- Legacy Grant Deprecation: Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).
- Identity Orchestration (DaVinci): Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn).
- GCP Cloud DevOps: Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).
- Future Cloud IdP Readiness: Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.
- Developer Experience: Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.
Experience
- Total Experience: 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
- Technical Leadership: 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
- Enterprise Scale: Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).
- Ping Identity & DaVinci Orchestration: Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design. (Note: PingAccess is not used in this environment).
- Authorization & Identity Modernization: Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES).
- Federation Protocols & Standards: Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation.
- Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities.
- Endpoints & Session Controls: Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.
- GCP & Cloud DevOps: Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash).
Preferred Certifications
- Ping Identity Certified Professional / Architect (PingFederate / PingOne)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
- Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
- Certified Information Systems Security Professional (CISSP)
- Certified Identity and Access Manager (CIAM)
Senior SSO Architect & Team Lead · Quantix