Identity Federation & PKI Engineer (Hybrid)

Koniag Services, Inc.; Washington (District of Columbia); Hybride; USD 120 000 - 190 000; Plein temps

Avantages offerts par ce poste

Medical, dental, and vision insurance

401(k) retirement plan

Paid time off

Parental leave

Life and disability insurance

Flexible spending accounts

Commuter benefits

Tuition reimbursement

Résumé du poste

Koniag Government Services seeks an IAM & PKI Engineer to support a federal client in Washington, DC. The role is hybrid, focusing on cross-domain identity integration, SSO, and secure token exchange across Ping Identity, Okta, and Entra.

The engineer will manage PKI operations, MFA, and phishing-resistant authentication, aligning with federal standards and cloud identity ecosystems. Strong scripting and IaC skills are required.

Qualifications

• Bachelor’s degree in a related field required.
• 6–10+ years of IAM and network security engineering experience.
• Minimum of 4 years configuring federated identity and enterprise PKI.

Responsabilités

• Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OIDC).
• Configure and troubleshoot identity topologies using Ping Identity, Okta, and Entra.
• Implement passwordless and phishing-resistant authentication (FIDO2/WebAuthn).
• Manage PKI lifecycles, CAs, and integration with PIV/CAC and IdPs.

Connaissances

Ping Identity

Okta

Microsoft Entra

OIDC

OAuth 2.0

SAML 2.0

FIDO/WebAuthn

ADCS

PowerShell

Python

Formation

Bachelor’s Degree

Outils

Ping Identity

Okta

Microsoft Entra

ADCS

Description du poste

Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking an experienced Identity Federation & PKI Engineer to support KOS enterprise identity and access management operations for a federal government client located in Washinton D.C. This position the ability to obtain and maintain a Public Trust. This is a Hybrid opportunity.

Benefits

• medical, dental, and vision insurance
• 401(k) retirement plan
• paid time off
• paid parental leave
• life and disability insurance
• flexible spending accounts
• commuter benefits
• tuition reimbursement

The Identity Federation & PKI Engineer serves as a core technical expert responsible for supporting designs from the ICAM Lead, Entra and Okta developers implementing, securing, and maintaining enterprise-wide identity federation frameworks and Public Key Infrastructure (PKI) systems. This role is highly technical, focusing on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication pathways.

Operating within a multi-cloud enterprise ecosystem, the engineer will manage seamless single sign-on (SSO) and lifecycle integration across products such as Ping Identity, Okta, and Microsoft Entra. The ideal candidate possesses deep expertise in modern authentication protocols—specifically OIDC, OAuth, and FIDO—coupled with traditional PKI and PIV/CAC card ecosystem management to drive the agency's Zero Trust Architecture (ZTA) and federal compliance goals.

Principal responsibilities will include but are not limited to:

• Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OpenID Connect [OIDC]) across disparate environments, SaaS products, and legacy systems.
• Configure, optimize, and troubleshoot complex identity topologies utilizing Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
• Work close with Entra and Okta team leads to Implement secure API authorization mechanisms and custom token attributes/claims structures using OAuth frameworks.
• Support and implement passwordless and phishing-resistant authentication mechanisms utilizing FIDO2 / WebAuthn standards.

Public Key Infrastructure (PKI) & Credential Engineering

• Manage enterprise certificate lifecycles, including Root/Issuing Certificate Authorities (CAs), registration authorities, and revocation mechanisms (CRLs, OCSP).
• Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers (IdPs) for derived credentials and multi-factor authentication (MFA).
• Maintain the security and cryptographic integrity of PKI hardware security modules (HSMs) and software systems in alignment with federal mandates (FIPS 140-3).
• Troubleshoot complex certificate validation issues, trust chain configurations, and cross-realm trust setups.
• Strong understanding of Azure Key Vault and Key Management Systems
• Strong Understanding of Post Quantum Cryptography

Platform Integration & Lifecycle Management

• Facilitate secure inbound/outbound provisioning pathways (SCIM, Just-In-Time) between Ping, Okta, and Microsoft Entra to ensure unified user profiles.
• Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across all identity platforms.
• Document system architectures, engineering designs, security controls, and deployment cookbooks to ensure standardizable configurations.

DevSecOps & Testing Automation

• Support the automation of federation deployments and infrastructure-as-code (IaC) configuration for identity environments using DevSecOps pipelines - Super Intelligence (SI).
• Develop and execute precise Test Plans and Test Summaries verifying federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.

Required Qualifications

• U.S. Citizen
• Bachelor’s Degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
• 6–10+ years of engineering experience focused on Identity and Access Management (IAM) and network security.
• Minimum of 4 years of hands‑on experience configuring and supporting federated identity solutions and enterprise PKI.

Technical & Professional Skills

• Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
• Deep, authoritative knowledge of identity protocols: OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
• Hands‑on experience with Microsoft Active Directory Certificate Services (ADCS) or commercial PKI software platforms (e.g., DigiCert, Entrust).
• Strong understanding of federal cybersecurity mandates (Executive Order 14028, NIST SP 800-63-3, FICAM profiles).
• Experience with scripting languages (PowerShell, Python, Bash) or API tooling (Postman) to test and automate identity lifecycle functions.
• Analytical ability to decode SAML assertions, OIDC JWT tokens, and trace network/HTTPS handshakes to isolate protocol failures.

Our Equal Employment Opportunity Policy:

The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race, color, religion, creed, ethnicity, sex, sexual orientation, gender or gender identity (except where gender is a bona fide occupational qualification), national origin or ancestry, age, disability, citizenship, military/veteran status, marital status, genetic information or any other characteristic protected by applicable federal, state, or local law. We are committed to equal employment opportunity in all decisions related to employment, promotion, wages, benefits, and all other privileges, terms, and conditions of employment.

The company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or to apply to a position on our website, please contact Heaven Wood via e‑mail at [e-mail] or by calling 703-488-9377 to request accommodations.

Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions, Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag, we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical, professional, and operational solutions. KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery. We ensure long‑term success with a continuous improvement approach while balancing the collective interests of our customers, employees, and native communities. For more information, please visit www.koniag-gs.com.

Equal Opportunity Employer/Veterans/Disabled. Shareholder Preference in accordance with Public Law 88-352