Senior SSO Architect & Team Lead

Job Description

Senior SSO Architect & Team Lead

\n

Role Overview

\n

A leading enterprise healthcare organization is seeking an experienced, forward-thinking Senior SSO Architect & Team Lead to direct an identity engineering squad and serve as the technical authority for enterprise authentication.

\n

\n

In this role, you will maintain high availability for core Ping federation infrastructure, lead a major cloud migration to PingOne Workforce Cloud, and partner across enterprise architecture and security teams to build a modern, Zero Trust authentication ecosystem supporting 70,000+ corporate, distributed, and clinical end users.

\n

\n

Key Responsibilities

\n

1. Team Leadership & Architecture Governance

\n

\n
• Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad within an Agile/Scrum framework, driving engineering quality and operational rigor.
\n
• Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align identity roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
\n
• Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization policy engines (e.g., Oracle Entitlement Server / OES).
\n
• Microsoft Ecosystem Collaboration: Partner with M365 and endpoint engineering teams to ensure seamless federation, Primary Refresh Token (PRT) evaluation, Conditional Access handoffs, and frictionless login workflows.
\n

\n

2. Operational Reliability & Current Environment

\n

\n
• Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) across core identity infrastructure, including PingFederate, PingDirectory, and PingID.
\n
• Workforce & CIAM Integrations: Manage integrations for customer-facing identity (CIAM via PingOne Customer) and support workforce authentication across standard workstations, shared clinical kiosks, and Citrix VDI environments.
\n
• Application Federation: Onboard and configure clinical information systems (EHR/EMR), custom business applications, and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
\n
• Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate service interruptions.
\n

\n

3. Modernization & Future Architecture

\n

\n
• Cloud Workforce Migration: Spearhead the migration of enterprise workforce authentication to PingOne Workforce Cloud and champion cloud-native identity modernization.
\n
• Standards Enforcement: Champion and enforce enterprise SSO standards ("Configuration over Customization"), establishing strict governance for application onboarding and architecture exception reviews.
\n
• Legacy Grant Deprecation: Deprecate insecure and legacy authentication methods (e.g., transitioning applications from Resource Owner Password Credentials / ROPC to OAuth 2.0 Authorization Code with PKCE).
\n
• Identity Orchestration (DaVinci): Architect dynamic identity orchestration journeys using PingOne DaVinci, integrating adaptive risk-based MFA (PingOne Protect) and passwordless authentication (FIDO2, WebAuthn).
\n
• GCP Cloud DevOps: Advance identity infrastructure automation on Google Cloud Platform (GCP) utilizing Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Kubernetes Engine (GKE).
\n
• Future Cloud IdP Strategy: Maintain architectural readiness for potential future adoption and integration with cloud identity platforms such as Microsoft Entra ID.
\n
• Developer Experience: Streamline internal developer onboarding through self-service tools, dynamic JWKS key discovery, and automated CI/CD deployment hooks.
\n

\n

\n

Required Qualifications & Experience

\n

Professional Experience

\n

\n
• Total IAM Experience: 8+ years of dedicated experience in enterprise Identity & Access Management (IAM) and Single Sign-On (SSO) architecture/engineering.
\n
• Technical Leadership: 2+ years leading engineering squads, mentoring technical staff, and collaborating directly with Enterprise Architecture and Security teams.
\n
• Enterprise Scale: Proven background maintaining high-availability, mission-critical identity infrastructure in large, regulated environments (healthcare, HIPAA, or financial services experience highly preferred).
\n

\n

Technical Competencies

\n

\n
• Ping Identity Suite & DaVinci Orchestration: Deep engineering expertise with PingFederate, PingID, PingDirectory, PingCentral, and PingOne Workforce Cloud/Customer. Strong hands-on proficiency designing user journeys and orchestration flows in PingOne DaVinci. (Note: PingAccess is not used in this environment).
\n
• Federation Protocols & Standards: Expert-level mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep practical knowledge of modern grant flows (Authorization Code + PKCE, Token Exchange) and legacy grant remediation.
\n
• Authorization Concepts: Strong understanding of fine-grained, externalized authorization models (ABAC/PBAC) and integrating modern policy engines (such as PingAuthorize) with enterprise SSO platforms.
\n
• Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to streamline user login and support long-term cloud identity roadmap initiatives.
\n
• Endpoint & Session Controls: Experience establishing session policies, Single Logout (SLO), and context-aware MFA rules across managed endpoints, shared frontline/clinical terminals, and virtualized desktops (Citrix VDI).
\n
• Cloud & DevOps Automation: Direct DevOps and Infrastructure as Code experience on Google Cloud Platform (GCP), including Terraform, Kubernetes (GKE), Docker, CI/CD pipeline automation (GitLab CI / Jenkins), REST APIs, and scripting (Python, Bash, or PowerShell).
\n

\n

Preferred Certifications

\n

\n
• Ping Identity Certified Professional / Architect (PingFederate / PingOne)
\n
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
\n
• Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
\n
• Certified Information Systems Security Professional (CISSP)
\n
• Certified Identity and Access Manager (CIAM)
\n

\n

\n