Senior SSO Architect

Senior SSO Architect/Team Lead

Location: Denver, CO

12 Plus Months Contract

Key Responsibilities:

Team Leadership & Architecture Governance

• Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
• Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
• Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).
• Microsoft Ecosystem Collaboration: Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.

Operational Reliability & Current Environment

• Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID.
• Workforce & CIAM Integrations: Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
• Application Federation: Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
• Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.

Modernization & Future Architecture

• Cloud Workforce Migration: Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
• Standards Enforcement: Champion and enforce client SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
• Legacy Grant Deprecation: Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).
• Identity Orchestration (DaVinci): Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn).
• GCP Cloud DevOps: Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).
• Future Cloud IdP Readiness: Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.
• Developer Experience: Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.

Experience:

• Total Experience: 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
• Technical Leadership: 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
• Enterprise Scale: Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).

Technical Competencies:

• Ping Identity & DaVinci Orchestration: Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design. (Note: PingAccess is not used in this environment).
• Authorization & Identity Modernization: Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES).
• Federation Protocols & Standards: Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation.
• Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities.
• Endpoints & Session Controls: Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.
• GCP & Cloud DevOps: Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash).

Core Soft Skills:

• Strategic Problem Solver: Balances rigorous security controls with frictionless clinical and teammate user workflows.
• Collaborative Communicator: Effectively translates enterprise architectural blueprints into technical implementations and communicates clearly across all levels.
• Team Coach: Dedicated to developing engineering talent and fostering a culture of technical excellence.

Preferred Certifications:

• Ping Identity Certified Professional / Architect (PingFederate / PingOne)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
• Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
• Certified Information Systems Security Professional (CISSP)
• Certified Identity and Access Manager (CIAM)