Senior SSO Architect & Team Lead

Agile Resources, Inc.; Denver (CO); On-site; USD 140,000 - 190,000; Full time

Job summary

Agile Resources, Inc. is seeking a Senior SSO Architect & Team Lead to direct an identity engineering squad and act as the technical authority for enterprise authentication across a large healthcare environment.

You will oversee 24x7 high availability of core Ping federation infrastructure, lead a major cloud migration to PingOne Workforce Cloud, and partner with Enterprise Architecture and Security to build a modern, Zero Trust authentication ecosystem for 70,000+ users.

Qualifications

• 8+ years in enterprise IAM and SSO architecture/engineering.
• 2+ years guiding engineering squads and cross-functional collaboration.
• Experience maintaining high-availability identity infrastructure in regulated environments.
• Deep expertise with Ping Identity suite and DaVinci orchestration.
• Strong mastery of SAML, OAuth, OIDC, JWT, and SCIM; PKCE and modern grant flows.
• Knowledge of ABAC/PBAC and externalized authorization models.
• Familiarity with Microsoft Entra ID and Hybrid Identity concepts.
• Experience with cloud DevOps on GCP, IaC, and containerized deployments.

Responsibilities

• Lead, mentor, and technically direct the SSO engineering squad in an Agile setting.
• Align identity roadmaps with enterprise architecture and ARB reviews.
• Evaluate modern authorization engines and replace legacy policies.
• Collaborate with M365 and endpoint teams for seamless federation and login workflows.
• Maintain 24x7 HA for core identity infra (PingFederate, PingDirectory, PingID).
• Oversee cloud migration to PingOne Workforce Cloud and cloud-native identity modernization.
• Enforce enterprise SSO standards and governance for onboarding and architectures.
• Drive DaVinci orchestration, adaptive risk-based MFA, and passwordless auth initiatives.
• Lead CIAM/workforce integrations across CIAM platforms and SaaS apps.

Skills

Technical leadership

IAM expertise

SSO architecture

Agile/Scrum

Cross-functional collaboration

Tools

PingFederate

PingDirectory

PingID

PingOne Workforce Cloud

PingOne Customer

OAuth 2.0

OIDC

SAML 2.0

PKCE

JWT

SCIM

Azure Entra ID / Microsoft 365 federation

GCP

Terraform

Kubernetes (GKE)

CI/CD (GitLab/Jenkins)

Python / Bash / PowerShell

Job description

A leading enterprise healthcare organization is seeking an experienced, forward-thinking Senior SSO Architect & Team Lead to direct an identity engineering squad and serve as the technical authority for enterprise authentication.

In this role, you will maintain high availability for core Ping federation infrastructure, lead a major cloud migration to PingOne Workforce Cloud, and partner across enterprise architecture and security teams to build a modern, Zero Trust authentication ecosystem supporting 70,000+ corporate, distributed, and clinical end users.

Key Responsibilities

• Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad within an Agile/Scrum framework, driving engineering quality and operational rigor.
• Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align identity roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
• Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization policy engines (e.g., Oracle Entitlement Server / OES).
• Microsoft Ecosystem Collaboration: Partner with M365 and endpoint engineering teams to ensure seamless federation, Primary Refresh Token (PRT) evaluation, Conditional Access handoffs, and frictionless login workflows.

2. Operational Reliability & Current Environment

• Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) across core identity infrastructure, including PingFederate, PingDirectory, and PingID.
• Workforce & CIAM Integrations: Manage integrations for customer-facing identity (CIAM via PingOne Customer) and support workforce authentication across standard workstations, shared clinical kiosks, and Citrix VDI environments.
• Application Federation: Onboard and configure clinical information systems (EHR/EMR), custom business applications, and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
• Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate service interruptions.
• Cloud Workforce Migration: Spearhead the migration of enterprise workforce authentication to PingOne Workforce Cloud and champion cloud-native identity modernization.
• Standards Enforcement: Champion and enforce enterprise SSO standards ("Configuration over Customization"), establishing strict governance for application onboarding and architecture exception reviews.
• Legacy Grant Deprecation: Deprecate insecure and legacy authentication methods (e.g., transitioning applications from Resource Owner Password Credentials / ROPC to OAuth 2.0 Authorization Code with PKCE).
• Identity Orchestration (DaVinci): Architect dynamic identity orchestration journeys using PingOne DaVinci, integrating adaptive risk-based MFA (PingOne Protect) and passwordless authentication (FIDO2, WebAuthn).
• GCP Cloud DevOps: Advance identity infrastructure automation on Google Cloud Platform (GCP) utilizing Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Kubernetes Engine (GKE).
• Future Cloud IdP Strategy: Maintain architectural readiness for potential future adoption and integration with cloud identity platforms such as Microsoft Entra ID.
• Developer Experience: Streamline internal developer onboarding through self-service tools, dynamic JWKS key discovery, and automated CI/CD deployment hooks.

Required Qualifications & Experience

Professional Experience

• Total IAM Experience: 8+ years of dedicated experience in enterprise Identity & Access Management (IAM) and Single Sign-On (SSO) architecture/engineering.
• Technical Leadership: 2+ years leading engineering squads, mentoring technical staff, and collaborating directly with Enterprise Architecture and Security teams.
• Enterprise Scale: Proven background maintaining high-availability, mission-critical identity infrastructure in large, regulated environments (healthcare, HIPAA, or financial services experience highly preferred).
• Ping Identity Suite & DaVinci Orchestration: Deep engineering expertise with PingFederate, PingID, PingDirectory, PingCentral, and PingOne Workforce Cloud/Customer. Strong hands-on proficiency designing user journeys and orchestration flows in PingOne DaVinci. Note: PingAccess is not used in this environment.
• Federation Protocols & Standards: Expert-level mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep practical knowledge of modern grant flows (Authorization Code + PKCE, Token Exchange) and legacy grant remediation.
• Authorization Concepts: Strong understanding of fine-grained, externalized authorization models (ABAC/PBAC) and integrating modern policy engines (such as PingAuthorize) with enterprise SSO platforms.
• Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to streamline user login and support long-term cloud identity roadmap initiatives.
• Endpoint & Session Controls: Experience establishing session policies, Single Logout (SLO), and context-aware MFA rules across managed endpoints, shared frontline/clinical terminals, and virtualized desktops (Citrix VDI).
• Cloud & DevOps Automation: Direct DevOps and Infrastructure as Code experience on Google Cloud Platform (GCP), including Terraform, Kubernetes (GKE), Docker, CI/CD pipeline automation (GitLab CI / Jenkins), REST APIs, and scripting (Python, Bash, or PowerShell).

Preferred Certifications

• Ping Identity Certified Professional / Architect (PingFederate / PingOne)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
• Certified Information Systems Security Professional (CISSP)
• Certified Identity and Access Manager (CIAM)