Senior SSO Architect - PingFederate / PingOne

Tranzeal Incorporated; Denver (CO); On-site; USD 180,000 - 240,000; Full time

Job summary

Tranzeal Incorporated in Denver is seeking an experienced Senior SSO Architect & Team Lead to drive enterprise single sign-on initiatives, oversee Ping Identity solutions, and guide the migration to PingOne Workforce Cloud.

You will mentor the SSO engineering team, design scalable IAM architectures, enhance authentication security, and collaborate with security, architecture, and application teams to standardize identity across the organization.

Qualifications

• 8+ years IAM and enterprise SSO experience.
• 2+ years technical leadership or team lead experience.
• Hands-on with PingFederate, Ping Identity, and PingOne DaVinci.
• Expertise in SAML, OAuth 2.0, OIDC, JWT, and SCIM.
• Familiar with Microsoft Entra ID / Azure AD and MFA.

Responsibilities

• Lead and mentor the SSO engineering team and guide technical architecture decisions.
• Manage and support PingFederate, PingDirectory, PingID, PingOne, and PingOne DaVinci.
• Design and maintain enterprise SSO and federation integrations using SAML 2.0, OAuth 2.0, OIDC, JWT, and SCIM.
• Lead workforce authentication migration to PingOne Workforce Cloud.
• Develop identity orchestration workflows, adaptive MFA, and passwordless authentication solutions.
• Support Microsoft 365 federation, hybrid identity, and Conditional Access integrations.
• Improve authentication security, certificate management, and high availability.
• Support cloud DevOps automation using GCP, Terraform, Kubernetes, Docker, and CI/CD pipelines.
• Collaborate with security, architecture, and application teams to implement enterprise IAM standards.

Skills

IAM engineering

SSO leadership

Technical leadership

Communication

Strategic planning

Tools

PingFederate

PingDirectory

PingID

PingOne

PingOne DaVinci

GCP

Terraform

Kubernetes

Docker

CI/CD

Microsoft Entra ID

Azure AD

Job description

Job Description

We are looking for an experienced Senior SSO Architect & Team Lead to lead enterprise Single Sign-On (SSO) engineering, manage Ping Identity solutions, and support the migration to PingOne Workforce Cloud. The ideal candidate should have strong hands‑on IAM expertise, technical leadership experience, and knowledge of cloud‑based identity modernization.

Key Responsibilities

• Lead and mentor the SSO engineering team and guide technical architecture decisions.
• Manage and support PingFederate, PingDirectory, PingID, PingOne, and PingOne DaVinci.
• Design and maintain enterprise SSO and federation integrations using SAML 2.0, OAuth 2.0, OIDC, JWT, and SCIM.
• Lead workforce authentication migration to PingOne Workforce Cloud.
• Develop identity orchestration workflows, adaptive MFA, and passwordless authentication solutions.
• Support Microsoft 365 federation, hybrid identity, and Conditional Access integrations.
• Improve authentication security, certificate management, and high availability.
• Support cloud DevOps automation using GCP, Terraform, Kubernetes, Docker, and CI/CD pipelines.
• Collaborate with security, architecture, and application teams to implement enterprise IAM standards.

Required Qualifications

• 8+ years of experience in IAM and enterprise SSO engineering.
• 2+ years of technical leadership or engineering team lead experience.
• Strong hands‑on experience with PingFederate, Ping Identity, and PingOne DaVinci.
• Expertise in SAML, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM.
• Experience with PingOne Workforce Cloud and identity federation.
• Knowledge of Microsoft Entra ID/Azure AD, Microsoft 365 federation, MFA, and session management.
• Hands‑on experience with GCP, Terraform, Kubernetes/GKE, Docker, and CI/CD automation.
• Strong communication, troubleshooting, and technical mentoring skills.

Preferred: Healthcare or HIPAA experience, Ping Identity certifications, Microsoft identity certifications, GCP certifications, or CISSP.