Senior AWS Cognito Engineer

Core AI Consulting Inc; Phoenix (AZ); On-site; USD 140,000 - 180,000; Full time

Job summary

Core AI Consulting Inc. is seeking a Senior AWS Cognito and Okta IAM Engineer to design, implement, and support secure identity and access management solutions for cloud-based applications.

You will focus on Cognito, Okta Identity Cloud, authentication and authorization, federation, user lifecycle, and integration with AWS services and enterprise apps. Strong expertise in OAuth, OIDC, SAML, SCIM, and JWT is essential.

Qualifications

• 7+ years of software/cloud engineering, cybersecurity, or IAM.
• 3+ years with Amazon Cognito and Okta hands-on.
• Deep knowledge of Cognito User Pools, Identity Pools, Lambda triggers, groups.
• Experience integrating Cognito with Okta via SAML 2.0 or OIDC.

Responsibilities

• Design and implement IAM/CIAM solutions using Cognito and Okta.
• Integrate with AWS services and enterprise applications.
• Configure MFA, SSO, API access management, and adaptive controls.
• Automate provisioning with SCIM and manage user lifecycles.
• Develop security standards, runbooks, and documentation.

Skills

Amazon Cognito

Okta

IAM

CIAM

OAuth 2.0

OIDC

SAML 2.0

SCIM

JWT

Terraform

AWS CDK

CloudFormation

Lambda

API Gateway

CloudWatch

WAF

Zero Trust

Least Privilege

Security Documentation

Cross-functional Collaboration

Education

Bachelor's degree in Computer Science, Information Technology, or related field

Tools

Okta API/SDKs

Okta Lifecycle Management

Okta Workflows

Terraform

AWS CDK

CloudFormation

Lambda

Cognito API/SDKs

Job description

We are seeking a Senior AWS Cognito and Okta IAM Engineer to design, implement, and support secure identity and access management solutions for cloud-based web, mobile, and enterprise applications. This role will focus on Amazon Cognito, Okta Identity Cloud, authentication and authorization, identity federation, user lifecycle management, and integration with AWS services and enterprise applications.

The ideal candidate has strong experience implementing scalable IAM and CIAM solutions using Amazon Cognito and Okta, along with modern identity standards such as OAuth 2.0, OpenID Connect, SAML 2.0, SCIM, and JWT.

Key Responsibilities

• Design and implement authentication and authorization solutions using Amazon Cognito User Pools and Identity Pools.
• Configure Cognito user registration, sign-in, account recovery, MFA, passwordless authentication, passkeys, and custom authentication flows.
• Integrate Amazon Cognito with Okta and other enterprise identity providers using SAML 2.0 and OpenID Connect.
• Configure Okta as an identity provider for Cognito-based web and mobile applications.
• Design and administer Okta Identity Engine, Universal Directory, applications, groups, profiles, policies, and authentication flows.
• Configure Okta Single Sign-On, Adaptive MFA, API Access Management, and contextual access policies.
• Implement automated user provisioning, profile synchronization, group management, and deprovisioning using SCIM.
• Build identity lifecycle processes using Okta Lifecycle Management and Okta Workflows.
• Develop custom integrations using Okta APIs, SDKs, Event Hooks, Inline Hooks, and Workflows Connector Builder.
• Configure Okta Sign-In Widget and Okta Auth SDKs for customized application authentication experiences.
• Implement OAuth 2.0 and OpenID Connect flows for web, mobile, single-page, machine-to-machine, and server-side applications.
• Configure app clients, callback URLs, domains, scopes, resource servers, groups, claims, and token-expiration policies.
• Implement secure access-token, ID-token, and refresh-token handling, including JWT validation and token rotation.
• Develop customized Cognito authentication and user-management processes using AWS Lambda triggers.
• Integrate Cognito with Amazon API Gateway, AWS Lambda, Application Load Balancer, AppSync, and other AWS services.
• Implement role-based and attribute-based access control using IAM roles, Okta groups, policies, scopes, claims, and user attributes.
• Protect authentication endpoints using AWS WAF, rate limiting, threat protection, and security-monitoring controls.
• Configure logging, monitoring, auditing, and alerting using Okta System Log, Amazon CloudWatch, and AWS CloudTrail.
• Troubleshoot authentication failures, SSO issues, federation errors, token-validation problems, provisioning failures, and access-control defects.
• Automate Cognito and Okta configurations using Terraform, AWS CDK, or AWS CloudFormation.
• Develop technical documentation, architecture diagrams, identity standards, security controls, and operational runbooks.
• Collaborate with application, cloud, DevOps, cybersecurity, compliance, and enterprise architecture teams.
• Participate in code reviews, security assessments, production deployments, incident response, and root-cause analysis.

Required Qualifications

• 7+ years of experience in software engineering, cloud engineering, cybersecurity, or identity and access management.
• 3+ years of hands-on experience with Amazon Cognito and Okta.
• Strong knowledge of Cognito User Pools, Identity Pools, app clients, resource servers, groups, domains, and Lambda triggers.
• Hands-on experience with Okta Identity Engine, Universal Directory, SSO, Adaptive MFA, and API Access Management.
• Experience integrating Amazon Cognito with Okta using SAML 2.0 or OpenID Connect.
• Strong understanding of OAuth 2.0, OIDC, SAML 2.0, SCIM 2.0, JWT, PKCE, authorization-code flow, and client-credentials flow.
• Experience implementing user provisioning and deprovisioning with Okta Lifecycle Management and SCIM.
• Experience configuring authentication policies, sign-on policies, group rules, profile mappings, claims, and authorization servers.
• Hands-on experience with AWS IAM, API Gateway, Lambda, CloudWatch, CloudTrail, WAF, KMS, and Secrets Manager.
• Experience integrating identity services with React, Angular, mobile, Java/Spring Boot, or other modern applications.
• Experience using Terraform, AWS CDK, or CloudFormation for identity infrastructure automation.
• Strong understanding of least-privilege access, Zero Trust principles, secure session management, secrets management, and API security.
• Strong troubleshooting, documentation, communication, and cross-functional collaboration skills.

Preferred Qualifications

• Okta Certified Professional, Administrator, Consultant, or Developer certification.
• AWS Certified Security – Specialty or AWS Certified Solutions Architect certification.
• Experience migrating users from legacy identity platforms to Amazon Cognito or Okta.
• Experience designing high-volume workforce IAM or customer identity and access management platforms.
• Familiarity with Okta Identity Governance, access certification, entitlement management, and segregation-of-duties controls.
• Experience integrating Okta with Active Directory, Microsoft Entra ID, HR systems, and SaaS applications.
• Knowledge of OWASP security practices and common identity-related threats.
• Experience working in financial services, healthcare, insurance, or other regulated environments.
• Experience with CI/CD pipelines, automated identity testing, and security validation.