IAM Architect – PingOne Workforce Cloud

IAM Architect – PingOne Workforce Cloud

The full job description covers all associated skills, previous experience, and any qualifications that applicants are expected to have.

• W2 Only role.
• Candidates must be authorized to work in the United States.
• Sponsorship is not available for this position.

Role Overview

Seeking a hands-on Senior SSO Architect & Team Lead to lead the SSO engineering team, maintain a highly available enterprise Ping Identity environment, and drive migration to PingOne Workforce Cloud. The role focuses on enterprise authentication, identity orchestration, Zero Trust security, and cloud automation for 70,000+ corporate and clinical users.

Key Responsibilities

• Lead and mentor the SSO engineering team and collaborate with Enterprise Architecture and Security teams.
• Maintain high availability of PingFederate, PingDirectory, PingID, and enterprise federation services.
• Lead migration to PingOne Workforce Cloud and modernize authentication architecture.
• Design and manage application integrations using SAML 2.0, OAuth 2.0, OIDC, JWT, and SCIM.
• Build identity orchestration workflows using PingOne DaVinci, adaptive MFA, and passwordless authentication.
• Support authorization modernization, including PingAuthorize and replacement of legacy Oracle Entitlement Server (OES).
• Collaborate on Microsoft 365 federation, Entra ID, Conditional Access, and hybrid identity.
• Automate identity infrastructure using Google Cloud Platform, Terraform, GKE, Docker, CI/CD, and scripting.
• Govern certificate/key lifecycle, session policies, and secure authentication standards.

Required Qualifications

• 10+ years of hands-on IAM and enterprise SSO engineering experience.
• 4+ years of technical leadership and team mentoring experience.
• Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and PingOne DaVinci.
• Strong knowledge of SAML, OAuth 2.0, OIDC, JWT, SCIM, PKCE, and modern authentication flows.
• Understanding of authorization frameworks, ABAC/PBAC, and PingAuthorize.
• Familiarity with Microsoft 365 federation, Entra ID, Conditional Access, Intune, and PRT.
• Hands-on Google Cloud Platform, Terraform, Kubernetes/GKE, Docker, CI/CD, and Python, PowerShell, or Bash.
• Experience supporting mission-critical, highly available environments; healthcare/HIPAA experience preferred.
• Strong architecture governance, communication, and problem-solving skills.

Certifications

• Ping Identity Professional/Architect
• Microsoft SC-300 or SC-100
• Google Cloud DevOps Engineer or Cloud Security Engineer
• CISSP or CIAM