ForgeRock Identity Gateway (IG)/PingGateway, Engineer

Peraton; Reston (VA); On-site; USD 80,000 - 128,000; Full time

Job summary

ForgeRock IG/PingGateway Engineer role supporting a U.S. Department of Education IAM program. You will design and operate identity-aware reverse proxies and gateway solutions within a Zero Trust architecture and align with NIST, FedRAMP, and FISMA standards.

Responsibilities include configuring PingGateway, securing APIs, implementing OAuth 2.0, OpenID Connect, SAML, and MFA, and integrating with ForgeRock components in cloud, on-prem, and hybrid environments. U.S. citizenship required.

Qualifications

• 5+ years in Identity and Access Management (IAM)
• Bachelor's degree required or 9 years experience with HS diploma/equivalent
• Hands-on with ForgeRock IG / PingGateway or similar gateway solutions
• Experience in federal environments and Agile/Scrum teams
• Familiarity with OAuth 2.0, OpenID Connect, SAML 2.0, JWT, LDAP
• Scripting in Groovy/JavaScript
• Cloud/hybrid environments and CI/CD pipelines
• U.S. Citizenship and ability to obtain clearance

Responsibilities

• Design, configure, and maintain PingGateway (ForgeRock IG) as identity-aware reverse proxy
• Manage TLS termination, routing, and load balancer integrations
• Enforce identity and access policies at the network edge
• Develop JSON route configurations and gateway policies
• Implement filters/handlers/scripts for request/response transformation
• Support credential replay, token injections, header manipulation for legacy apps
• Secure APIs using PingGateway microgateway capabilities
• Implement OAuth 2.0, OpenID Connect, SAML integrations
• SSO, MFA, and federated identity flows
• Zero Trust gateway-based enforcement and adaptive authentication
• Develop Groovy and JavaScript scripts for gateway behavior
• Configure logging, metrics, and audit trails; integrate with SIEM/OpenTelemetry
• Deploy PingGateway in Docker/Kubernetes; support CI/CD pipelines
• Integrate PingGateway with ForgeRock components (AM, IDM, DS)
• Provide L3 support and root-cause analysis
• Ensure compliance with FISMA, FedRAMP, NIST guidelines

Skills

IAM

Agile/Scrum

REST APIs

OAuth 2.0

OpenID Connect

SAML 2.0

JWT

Zero Trust

Kubernetes

Docker

Groovy/JavaScript scripting

U.S. Citizenship

Education

Bachelor's degree

High School diploma or equivalent

Tools

ForgeRock IG / PingGateway

Kubernetes

Docker

CI/CD pipelines

Prometheus

OpenTelemetry

Job description

ForgeRock Identity Gateway (IG)/PingGateway Engineer

Job Locations: U.S.

Responsibilities

We are seeking a ForgeRock Identity Gateway (IG)/PingGateway Engineer to support a federal Identity and Access Management (IAM) program for the U.S. Department of Education Federal Student Aid (FSA). This role is responsible for designing and operating identity‑aware reverse proxy and gateway solutions that secure applications, APIs, and microservices across a Zero Trust architecture. The engineer will serve as a key Policy Enforcement Point (PEP) architect, ensuring consistent identity and access control enforcement across legacy, cloud, and hybrid systems in alignment with federal security standards such as NIST, FICAM, FedRAMP, and Zero Trust principles.

Key Responsibilities

Identity Gateway & Reverse Proxy Engineering

• Design, configure, and maintain PingGateway (ForgeRock IG) as an identity‑aware reverse proxy
• Manage HTTP/S traffic routing, TLS termination, and load balancer integrations
• Enforce identity and access policies at the network edge

Policy & Route Development

• Develop and maintain JSON‑based route configurations and gateway policies
• Implement filters, handlers, and scripts for request/response transformation
• Support credential replay, token injections, and header manipulation for legacy apps

API & Microservices Security

• Secure APIs using PingGateway microgateway capabilities
• Implement OAuth 2.0 resource server patterns and token validation
• Integrate with external authorization systems (e.g., PingAuthorize)

Authentication & Federation

• Implement SSO, MFA, and federated identity flows
• Configure OAuth 2.0, OpenID Connect (OIDC), and SAML integrations
• Support migration of legacy identity protocols to PingOne Advanced Identity Cloud

Zero Trust Enforcement

• Implement gateway‑based Policy Enforcement Points (PEP) within a Zero Trust architecture
• Enforce adaptive authentication and risk‑based access controls

Scripting & Customization

• Develop Groovy and JavaScript scripts for custom gateway behavior
• Build custom authentication, token handling, and audit logging logic

Observability & Monitoring

• Configure logging, metrics, and audit trails for gateway traffic
• Integrate with enterprise SIEM and monitoring tools (e.g., Prometheus, OpenTelemetry)

DevOps & Deployment

• Deploy PingGateway in Docker and Kubernetes environments
• Support CI/CD pipelines and infrastructure‑as‑code practices
• Work with hardened container environments for federal systems

Integration & Platform Support

• Integrate PingGateway with ForgeRock components (AM, IDM, DS)
• Support identity flows across hybrid and cloud environments

Troubleshooting & Support

• Provide L3 support for production incidents
• Perform root cause analysis and resolve complex identity and routing issues
• Ensure high availability and performance of gateway services

Compliance & Security

• Ensure compliance with FISMA, FedRAMP, NIST, and federal IAM standards
• Support audits, security assessments, and continuous monitoring requirements
• Participate in design reviews and agile ceremonies

Required Qualifications

• Bachelor's degree and 5 years of experience or 9 years with a HS diploma/equivalent
• 5+ years in Identity and Access Management (IAM)
• Hands‑on experience with ForgeRock IG / PingGateway or similar API gateway/IAM reverse proxy solutions
• Experience in enterprise or federal environments
• Experience working in Agile/Scrum teams
• ForgeRock IG / PingGateway (route configuration, scripting, policy design) experience
• Familiarity in OAuth 2.0, OpenID Connect, SAML 2.0, JWT, LDAP
• Groovy and JavaScript scripting experience
• Experience in REST APIs and microservices security
• Familiarity in Kubernetes, Docker, and CI/CD pipelines
• LDAP/Active Directory integration experience
• Understanding of Zero Trust architecture (NIST SP 800-207)
• Familiarity with cloud platforms (AWS, Azure, or GCP)
• U.S. Citizenship required
• Must be able to obtain and maintain the required agency clearance

Preferred Qualifications

• ForgeRock or Ping Identity certifications
• CISSP, Security+, or similar cybersecurity certifications
• Experience with PingAuthorize or externalized authorization models
• Experience with federal IAM programs (FSA, DHS, DoD, etc.)
• Knowledge of observability tools (Prometheus, OpenTelemetry)
• Experience with SailPoint, Okta, or CyberArk
• Familiarity with advanced security topics (mTLS, FAPI, PKI, or post‑quantum crypto)
• Agile/SAFe certifications

Target Salary Range

$80,000 - $128,000. This represents the typical salary range for this position. Salary is determined by various factors, including but not limited to, the scope and responsibilities of the position, the individual's experience, education, knowledge, skills, and competencies, as well as geographic location and business and contract considerations. Depending on the position, employees may be eligible for overtime, shift differential, and a discretionary bonus in addition to base pay.

EEO

Equal opportunity employer, including disability and protected veterans, or other characteristics protected by law.