Skip to main content
McCarthy Search

Senior Active Directory Architect

L7

ispaceDenver, CO4 days ago

Occupations

Computer Systems Engineers/ArchitectsNetwork and Computer Systems AdministratorsSoftware Developers

Industries

Computer Systems Design ServicesCustom Computer Programming ServicesSoftware Publishers
Senior SSO Architect/Team Lead
Location: Denver, CO12 Plus Months Contract
Key Responsibilities: Team Leadership & Architecture Governance Squad Leadership:
  • Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
  • Architecture Alignment:
  • Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).Authorization Modernization:
  • Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).Microsoft Ecosystem Collaboration:
  • Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.
  • Operational Reliability & Current Environment
  • Tier-0 High Availability:
  • Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID.Workforce & CIAM Integrations:
  • Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.Application Federation:
  • Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).Certificate & Key Lifecycle:
  • Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.
  • Modernization & Future Architecture
  • Cloud Workforce Migration:
  • Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
  • Standards Enforcement:
  • Champion and enforce client SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
  • Legacy Grant Deprecation:
Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).Identity Orchestration (DaVinci):Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn).GCP Cloud DevOps: Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).Future Cloud IdP Readiness: Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.Developer Experience: Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.
Experience:
  • Total Experience:8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
  • Technical Leadership:2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
  • Enterprise Scale:
  • Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).
Technical Competencies: Ping Identity & DaVinci Orchestration: Deep expertise in PingFederate, PingID, PingDirectory, Ping Central, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design. (Note: PingAccess is not used in this environment).Authorization & Identity Modernization:
  • Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES).Federation Protocols & Standards:
  • Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation.
  • Microsoft Federation & Cloud Identity:
  • Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities.
  • Endpoints & Session Controls:
  • Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.GCP & Cloud DevOps:
  • Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash).Core Soft Skills:
  • Strategic Problem Solver:
  • Balances rigorous security controls with frictionless clinical and teammate user workflows.
  • Collaborative Communicator:
  • Effectively translates enterprise architectural blueprints into technical implementations and communicates clearly across all levels.
  • Team Coach:
  • Dedicated to developing engineering talent and fostering a culture of technical excellence.
Preferred Certifications:
  • Ping Identity Certified Professional / Architect (PingFederate / PingOne)
  • Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
  • Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
  • Certified Information Systems Security Professional (CISSP)
  • Certified Identity and Access Manager (CIAM)
Apply now (opens in a new tab)
Apply now (opens in a new tab)

Level

ManagerL7

Location

Denver, CO

Occupation

Computer Systems Engineers/Architects

Industry

Computer Systems Design Services

Posted

4 days ago

To get sharper similar jobs, create your profile using the link below.

Create profile