Senior IAM Architect: Cognito & Okta (Hybrid)

Tekaccel Inc.; Phoenix (AZ); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Tekaccel, Inc. in Phoenix, AZ Hybrid is seeking a Senior AWS Cognito Engineer to design and implement secure identity and access management for cloud applications.

This hybrid, long-term contract role focuses on Cognito, Okta, OAuth/OIDC, SAML, and SCIM integrations across AWS services. You will build scalable IAM/CIAM solutions, automate workflows with Terraform or CDK, and collaborate with security, DevOps, and enterprise teams to deliver robust authentication and authorization.

Qualifications

• 7+ years of experience in software engineering, cloud engineering, cybersecurity, or identity and access management.
• 3+ years of hands‑on experience with Amazon Cognito and Okta.
• Strong knowledge of Cognito User Pools, Identity Pools, app clients, resource servers, groups, domains, and Lambda triggers.
• Hands‑on experience with Okta Identity Engine, Universal Directory, SSO, Adaptive MFA, and API Access Management.
• Experience integrating Amazon Cognito with Okta using SAML 2.0 or OpenID Connect.
• Strong understanding of OAuth 2.0, OIDC, SAML 2.0, SCIM 2.0, JWT, PKCE, authorization‑code flow, and client‑credentials flow.
• Experience implementing user provisioning and deprovisioning with Okta Lifecycle Management and SCIM.
• Experience configuring authentication policies, sign‑on policies, group rules, profile mappings, claims, and authorization servers.
• Experience developing integrations using Okta APIs, SDKs, Event Hooks, Inline Hooks, or Workflows.
• Hands‑on experience with AWS IAM, API Gateway, Lambda, CloudWatch, CloudTrail, WAF, KMS, and Secrets Manager.
• Proficiency in Python, Java, JavaScript/TypeScript, or Node.js for identity integrations and Lambda development.
• Experience integrating identity services with React, Angular, mobile, Java/Spring Boot, or other modern applications.
• Experience using Terraform, AWS CDK, or CloudFormation for identity infrastructure automation.
• Strong understanding of least‑privilege access, Zero Trust principles, secure session management, secrets management, and API security.
• Strong troubleshooting, documentation, communication, and cross‑functional collaboration skills.

Responsibilities

• Design and implement authentication and authorization solutions using Amazon Cognito User Pools and Identity Pools.
• Configure Cognito user registration, sign-in, account recovery, MFA, passwordless authentication, passkeys, and custom authentication flows.
• Integrate Amazon Cognito with Okta and other enterprise identity providers using SAML 2.0 and OpenID Connect.
• Configure Okta as an identity provider for Cognito-based web and mobile applications.
• Design and administer Okta Identity Engine, Universal Directory, applications, groups, profiles, policies, and authentication flows.
• Configure Okta Single Sign-On, Adaptive MFA, API Access Management, and contextual access policies.
• Implement automated user provisioning, profile synchronization, group management, and deprovisioning using SCIM.
• Build identity lifecycle processes using Okta Lifecycle Management and Okta Workflows.
• Develop custom integrations using Okta APIs, SDKs, Event Hooks, Inline Hooks, and Workflows Connector Builder.
• Configure Okta Sign-In Widget and Okta Auth SDKs for customized application authentication experiences.
• Implement OAuth 2.0 and OpenID Connect flows for web, mobile, single-page, machine-to-machine, and server‑side applications.
• Configure app clients, callback URLs, domains, scopes, resource servers, groups, claims, and token‑expiration policies.
• Implement secure access‑token, ID‑token, and refresh‑token handling, including JWT validation and token rotation.
• Develop customized Cognito authentication and user‑management processes using AWS Lambda triggers.
• Integrate Cognito with Amazon API Gateway, AWS Lambda, Application Load Balancer, AppSync, and other AWS services.
• Implement role‑based and attribute‑based access control using IAM roles, Okta groups, policies, scopes, claims, and user attributes.
• Protect authentication endpoints using AWS WAF, rate limiting, threat protection, and security‑monitoring controls.
• Configure logging, monitoring, auditing, and alerting using Okta System Log, Amazon CloudWatch, and AWS CloudTrail.
• Troubleshoot authentication failures, SSO issues, federation errors, token‑validation problems, provisioning failures, and access‑control defects.
• Automate Cognito and Okta configurations using Terraform, AWS CDK, or AWS CloudFormation.
• Develop technical documentation, architecture diagrams, identity standards, security controls, and operational runbooks.
• Collaborate with application, cloud, DevOps, cybersecurity, compliance, and enterprise architecture teams.
• Participate in code reviews, security assessments, production deployments, incident response, and root‑cause analysis.

Skills

AWS Cognito

Okta

OAuth 2.0

OIDC

SAML 2.0

SCIM

IAM

Python

Java

JavaScript/TypeScript

Node.js

Tools

Terraform

AWS CDK

CloudFormation

Okta APIs

AWS Lambda

Amazon API Gateway

CloudWatch

WAF

Job description

Tekaccel, Inc. in Phoenix, AZ Hybrid is seeking a Senior AWS Cognito Engineer to design and implement secure identity and access management for cloud applications.

This hybrid, long-term contract role focuses on Cognito, Okta, OAuth/OIDC, SAML, and SCIM integrations across AWS services. You will build scalable IAM/CIAM solutions, automate workflows with Terraform or CDK, and collaborate with security, DevOps, and enterprise teams to deliver robust authentication and authorization.