IAM Architect - PingOne Workforce Cloud

Job Description

IAM Architect – PingOne Workforce Cloud

\n

\n

\n
• W2 Only role.
\n
• Candidates must be authorized to work in the United States.
\n
• Sponsorship is not available for this position.
\n

\n

\n

Role Overview

\n

Seeking a hands-on Senior SSO Architect & Team Lead to lead the SSO engineering team, maintain a highly available enterprise Ping Identity environment, and drive migration to PingOne Workforce Cloud. The role focuses on enterprise authentication, identity orchestration, Zero Trust security, and cloud automation for 70,000+ corporate and clinical users.

\n

\n

Key Responsibilities

\n

\n
• Lead and mentor the SSO engineering team and collaborate with Enterprise Architecture and Security teams.
\n
• Maintain high availability of PingFederate, PingDirectory, PingID, and enterprise federation services.
\n
• Lead migration to PingOne Workforce Cloud and modernize authentication architecture.
\n
• Design and manage application integrations using SAML 2.0, OAuth 2.0, OIDC, JWT, and SCIM.
\n
• Build identity orchestration workflows using PingOne DaVinci, adaptive MFA, and passwordless authentication.
\n
• Support authorization modernization, including PingAuthorize and replacement of legacy Oracle Entitlement Server (OES).
\n
• Collaborate on Microsoft 365 federation, Entra ID, Conditional Access, and hybrid identity.
\n
• Automate identity infrastructure using Google Cloud Platform, Terraform, GKE, Docker, CI/CD, and scripting.
\n
• Govern certificate/key lifecycle, session policies, and secure authentication standards.
\n

\n

\n

Required Qualifications

\n

\n
• 10+ years of hands-on IAM and enterprise SSO engineering experience.
\n
• 4+ years of technical leadership and team mentoring experience.
\n
• Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and PingOne DaVinci.
\n
• Strong knowledge of SAML, OAuth 2.0, OIDC, JWT, SCIM, PKCE, and modern authentication flows.
\n
• Understanding of authorization frameworks, ABAC/PBAC, and PingAuthorize.
\n
• Familiarity with Microsoft 365 federation, Entra ID, Conditional Access, Intune, and PRT.
\n
• Hands-on Google Cloud Platform, Terraform, Kubernetes/GKE, Docker, CI/CD, and Python, PowerShell, or Bash.
\n
• Experience supporting mission-critical, highly available environments; healthcare/HIPAA experience preferred.
\n
• Strong architecture governance, communication, and problem-solving skills.
\n

\n

\n

Certifications

\n

\n
• Ping Identity Professional/Architect
\n
• Microsoft SC-300 or SC-100
\n
• Google Cloud DevOps Engineer or Cloud Security Engineer
\n
• CISSP or CIAM
\n

\n