IAM Architect Contractor: 6-9 years (Advanced) : Remote

Job Description

Job Description

Title : IAM Architect – ForgeRock / PingOne Advanced Identity Cloud (AIC)
Location: Remote
Duration: 6+Months (Possible Extension)

Job Title:

Job Summary
We are seeking an experienced and hands-on Customer Identity and Access Management (CIAM) Architect with deep expertise in modern identity protocols, ForgeRock technologies, and customer-facing digital identity solutions. The ideal candidate will be responsible for architecting, designing, developing, and implementing secure, scalable, and seamless identity experiences across web applications, mobile applications, APIs, and omnichannel digital platforms.
This role requires strong technical expertise in SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and the ForgeRock identity platform, along with experience in identity platform modernization and migration to PingOne Advanced Identity Cloud (AIC). The candidate must be comfortable working hands-on with application integrations, API security, authentication flows, and identity lifecycle management rather than focusing solely on IAM platform administration.
Key Responsibilities

• CIAM Architecture and Implementation: Architect, design, and deliver end-to-end Customer Identity and Access Management solutions covering authentication, authorization, identity lifecycle management, single sign-on (SSO), and API security.
• Identity Protocols: Implement and troubleshoot SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and JSON Web Tokens (JWT) across web, mobile, and API-based applications.
• ForgeRock Expertise: Provide hands-on expertise across ForgeRock Access Management (AM), Identity Management (IDM), Identity Gateway (IG), and Directory Services (DS), including architecture, development, integration, configuration, and production support.
• Digital Application Integration: Integrate identity and authentication capabilities directly into customer-facing web applications, mobile applications, digital products, and omnichannel customer journeys.
• Identity Experience Design: Collaborate with application development, product, UX, and security teams to deliver secure, scalable, and user-friendly authentication and authorization experiences.
• Web and Browser Security: Design and troubleshoot identity integrations involving browser security, cookies, CORS, session management, token handling, redirects, and modern authentication patterns.
• API Security: Design and secure REST APIs using industry-standard identity protocols, token validation, authorization controls, and API security best practices.
• Technical Leadership: Lead architecture and design reviews, establish technical standards, provide implementation guidance, resolve complex technical challenges, and mentor engineering teams.
• Cloud-Native Identity Solutions: Partner with platform engineering and DevOps teams to deploy and support scalable identity solutions in cloud-native environments. Experience with Microsoft Azure Kubernetes Service (AKS) and Kubernetes is a plus.
• Identity Platform Modernization: Lead or contribute to identity platform transformation initiatives, including migration from ForgeRock environments to PingOne Advanced Identity Cloud (AIC), covering solution design, integration planning, migration execution, testing, and production readiness.
• Production Support and Optimization: Troubleshoot complex authentication, authorization, federation, session, and API security issues while ensuring platform reliability, performance, scalability, and security compliance.

Required Qualifications and Skills

• Extensive hands-on experience in Customer Identity and Access Management (CIAM) architecture and implementation.
• Deep understanding and practical implementation experience with SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and JWT.
• Strong hands-on experience with ForgeRock AM, IDM, IG, and DS.
• Proven experience integrating identity services with customer-facing web applications, mobile applications, and REST APIs.
• Strong knowledge of authentication, authorization, SSO, identity federation, identity lifecycle management, and API security.
• Expertise in web technologies, browser security, cookies, CORS, session management, and token-based authentication.
• Experience designing scalable and secure identity architectures for modern digital platforms.
• Strong troubleshooting, analytical, communication, and cross-functional collaboration skills.
• Demonstrated ability to provide technical leadership, conduct architecture reviews, and mentor development teams.

Preferred Qualifications

• Experience with PingOne Advanced Identity Cloud (AIC), particularly migration from ForgeRock-based deployments.
• Experience with identity platform modernization, cloud migration, and enterprise CIAM transformation programs.
• Exposure to Azure Kubernetes Service (AKS), Kubernetes, containerized deployments, and cloud-native architecture.
• Experience collaborating with product, UX, application engineering, security, and DevOps teams.
• Understanding of secure software development practices and identity-related security standards.

Ideal Candidate Profile
The ideal candidate is a hands-on CIAM Architect who combines strong identity architecture knowledge with practical development and integration experience. The candidate should have a proven ability to embed identity and access management capabilities directly into digital products and customer-facing applications, deliver seamless customer authentication journeys, secure APIs, and lead identity platform modernization initiatives.
Candidates whose experience is limited to IAM platform administration, access provisioning, or operational support without substantial application integration and solution implementation experience may not be the right fit.