Security Token Service Engineer (Identity & Access Management (IAM) Engineer)

Virtual Service Operations; United States; Remote; USD 120,000 - 165,000; Full time

Benefits offered by this job

Health benefits

Flexible work arrangements

Career development opportunities

Job summary

VSO Inc. is seeking an experienced Security Token Service Engineer (IAM Engineer) to design, develop, and operate secure authentication and authorization services for a enterprise-wide platform modernization.

The role emphasizes token management, federation, and API security in a production environment. The ideal candidate will implement OAuth 2.0, OIDC, and SAML 2.0, manage credentials and PKI, and collaborate with platform and cybersecurity teams to deliver reusable identity services across

Qualifications

• Bachelor's degree or equivalent in CS, cybersecurity, software engineering, or related field.
• Minimum of 3 years hands-on IAM engineering experience.
• Experience implementing OAuth 2.0, OpenID Connect, and SAML 2.0 authentication and federation flows.
• Hands-on experience with token exchange, JWT validation, and token-based authentication.
• Experience integrating at least one enterprise identity provider (e.g., Microsoft Entra ID, ADFS, SiteMinder) and Keycloak as an identity broker.
• Proficiency with PKI, X.509 certificates, and TLS/mTLS; strong backend development with Java/Go/Python.

Responsibilities

• Design, develop, implement, and maintain authentication and authorization services for enterprise apps and APIs.
• Build and operate token services for issuance, exchange, validation, revocation, and introspection.
• Implement secure auth flows using OAuth 2.0, OIDC, and SAML 2.0; develop JWT validation and token management.
• Integrate identity providers and establish secure federation and SSO across apps and services.
• Configure and manage Keycloak realms, clients, providers, and protocol mappings.
• Document identity architectures, flows, and security models; support security reviews and audits.

Skills

IAM engineering

Authentication design

Troubleshooting

Education

Bachelor's degree or equivalent

Tools

OAuth 2.0

OIDC

SAML 2.0

JWT

Keycloak

TLS/mTLS

PKI

Job description

All Jobs > Security Token Service Engineer (Identity & Access Management (IAM) Engineer)

Security Token Service Engineer (Identity & Access Management (IAM) Engineer) Fully Remote USA AWS

Full-time

Description

Are you an experienced Identity & Access Management Engineer who enjoys building secure authentication and authorization solutions rather than simply administering existing IAM platforms? Are you interested in developing foundational security services that enable enterprise-wide data connectivity, API integration, and emerging AI capabilities?

Virtual Service Operations (VSO) is seeking an experienced Identity & Access Management (IAM) Engineer to support a high-visibility enterprise platform modernization initiative.

This initiative is focused on developing reusable software platforms and services that enable secure data connectivity, interoperability, and AI integration across a large, complex enterprise environment.

The project involves building foundational tools and capabilities that allow enterprise applications, databases, and services to securely exchange information through standardized APIs and Model Context Protocol (MCP) servers.

This is not a traditional IAM administration, cloud migration, or infrastructure support role. We are looking for a hands-on engineer who can design, develop, integrate, and operate secure authentication and authorization services in a production environment.

You will play a key role in establishing the identity and security foundation for an enterprise integration platform, including identity federation, token management, credential security, certificate trust, and API authorization enforcement.

Key Responsibilities

Identity & Authentication Services

• Design, develop, implement, and maintain authentication and authorization services supporting enterprise applications and APIs.
• Build and operate token services supporting token issuance, exchange, validation, revocation, and introspection.
• Implement secure authentication and authorization flows using OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0.
• Develop and maintain JSON Web Token (JWT) validation and token management capabilities.

Identity Federation & Integration

• Integrate enterprise identity providers, including Microsoft Entra ID, Active Directory Federation Services (ADFS), and SiteMinder.
• Configure and integrate Keycloak as an identity broker, including realms, clients, identity providers, and protocol mappers.
• Establish secure federation and single sign-on capabilities across enterprise applications and services.
• Troubleshoot complex authentication, federation, and authorization issues.

API Security & Authorization

• Implement authorization enforcement at API gateways using Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectural patterns.
• Develop and integrate secure access controls for APIs, applications, and backend services.
• Support standardized authentication and authorization approaches across distributed enterprise systems.
• Collaborate with platform and software engineering teams to integrate identity services into reusable enterprise capabilities.

Credential, Key & Certificate Management

• Manage credential and cryptographic key lifecycles, including client secrets, signing keys, rotation, and secure storage.
• Implement and maintain Public Key Infrastructure (PKI) and certificate trust configurations.
• Support X.509 certificates, certificate authority (CA) chains, TLS/mTLS, certificate issuance, renewal, and revocation.
• Apply security best practices to protect service-to-service communications and sensitive credentials.

Security Engineering & Documentation

• Document identity architectures, authentication flows, authorization models, and security integrations.
• Collaborate with cybersecurity, platform engineering, and development teams to ensure secure implementation.
• Support security assessments, technical reviews, audits, and authorization documentation.
• Contribute to scalable, reusable, and maintainable identity security solutions.

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience.
• Minimum of 3 years of hands-on experience in Identity & Access Management engineering, including designing, developing, or implementing authentication and authorization services in production environments.
• Demonstrated experience implementing OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 authentication and federation flows.
• Hands-on experience with token exchange, JWT validation, and token-based authentication.
• Experience integrating at least one enterprise identity provider, such as Microsoft Entra ID, ADFS, or SiteMinder.
• Experience with Keycloak or a comparable identity broker.
• Working knowledge of Public Key Infrastructure (PKI), X.509 certificates, and TLS/mTLS.
• Proficiency developing backend services using Java, Go, Python, or a comparable programming language.
• Strong troubleshooting, technical documentation, and problem-solving skills.
• Ability to collaborate effectively with software engineers, cloud architects, and cybersecurity professionals.

Preferred Qualifications

• Experience extending Keycloak using Service Provider Interfaces (SPIs), custom authenticators, or custom integrations.
• Experience implementing fine-grained authorization using Open Policy Agent (OPA) or comparable policy engines.
• Familiarity with Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectures.
• Experience with AWS Key Management Service (KMS), HashiCorp Vault, Hardware Security Modules (HSMs), or comparable key management technologies.
• Experience securing machine-to-machine communications, service accounts, and automated workloads.
• Familiarity with Model Context Protocol (MCP) and authorization approaches for AI-enabled applications or agents.
• Experience integrating identity and authorization services with API gateways.
• Familiarity with NIST 800-53, NIST 800-63, FedRAMP, or security authorization processes.
• Experience developing security services within AWS or other cloud environments.
• Experience supporting enterprise modernization, platform engineering, or distributed application integration initiatives.

Requirements

• This is a remote role
• Minimum of 3 years of hands-on experience in Identity & Access Management engineering
• New hires assigned on this project will be required to undergo and pass drug and alcohol tests per our client's contract requirements
• Please note that this specific position requires U.S. citizenship status

What is Important to Us:

• You are an excellent communicator in writing and speaking.
• You have the ability to work independently but also value teamwork.
• Your problem-solving skills are excellent.
• You are looking for a job where performance appraisals occur regularly, and you look forward to advancing your career.
• You seek a community of virtue-centered co-workers and clients.

What we offer you:

As part of the VSO company, you will be part of a virtue-centered team who value their work and teammates. This is a no-jerk zone. We provide ongoing learning and development opportunities to foster continuous growth. We offer competitive salaries, health benefits, and flexible work arrangements.

More About VSO

VSO is a hybrid cloud and managed services consulting firm. Much of VSO’s success can be attributed to our deep partnerships with IT services industry leaders such as AWS, IBM, Microsoft and others. VSO leverages numerous other partner relationships so as to provide our customers with optimal support. Additionally, we take pride in taking care of our employees. We offer a wide variety of benefits for eligible employees related to health, retirement, professional development, and more! For more information, please visit our website at https://vso-inc.com/careers