Lead SSO Architect

Role Overview

As the Principal SSO Architect & Identity Lead, you will direct the Single Sign-On engineering squad and serve as the technical authority for enterprise authentication. You will maintain high availability for core Ping federation services, lead the cloud migration to PingOne Workforce Cloud, and architect a modern Zero Trust identity ecosystem for 70,000+ teammates across corporate, clinical, and VDI environments.

Key Responsibilities

• Squad Leadership & Governance: Lead and mentor the SSO engineering squad in an Agile framework, align roadmaps with Enterprise Architecture, and represent SSO on Architecture Review Boards (ARB).
• Tier-0 High Availability: Ensure 99.99%+ availability for enterprise federation infrastructure (PingFederate, PingDirectory, PingID, and PingOne CIAM) across clinical systems (Epic, Cerner, CWOW) and SaaS platforms.
• Cloud Modernization & Orchestration: Lead migration to PingOne Workforce Cloud, deprecate legacy grants (ROPC to OAuth 2.0 Auth Code with PKCE), and architect dynamic user journeys using PingOne DaVinci and adaptive MFA.
• GCP Cloud DevOps: Automate identity infrastructure deployment using Infrastructure as Code (Terraform), Kubernetes (GKE), and CI/CD pipelines on Google Cloud Platform.
• Federation & Authorization Alignment: Partner with Microsoft/M365 teams on hybrid federation/Entra ID integration and evaluate modern authorization platforms (PingAuthorize).

Key Qualifications

• Experience: 8+ years in dedicated IAM/SSO engineering, with 2+ years leading engineering squads in enterprise healthcare or regulated environments.
• Ping Identity Suite: Deep mastery of PingFederate, PingDirectory, PingID, PingOne Workforce/CIAM, and PingOne DaVinci.
• Protocols & Standards: Expert-level SAML 2.0, OAuth 2.0, OIDC, JWT, SCIM, FIDO2/WebAuthn, and fine-grained authorization (ABAC/PBAC).
• Cloud & DevOps: Hands-on GCP DevOps expertise (Terraform, GKE, Docker, CI/CD pipelines) and scripting proficiency (Python, PowerShell, Bash).
• Preferred Certifications: Ping Identity Certified Architect, CISSP, SC-300 / SC-100, or GCP Professional Cloud Security Engineer.