Senior SSO Architect & Team Lead

Senior SSO Architect & Team LeadRole Overview A leading enterprise healthcare organization is seeking an experienced, forward-thinking Senior SSO Architect & Team Leadto direct an identity engineering squad and serve as the technical authority for enterprise authentication. In this role, you will maintain high availability for core Ping federation infrastructure, lead a major cloud migration to PingOne Workforce Cloud, and partner across enterprise architecture and security teams to build a modern, Zero Trust authentication ecosystem supporting 70,000+ corporate, distributed, and clinical end users. Key Responsibilities1. Team Leadership & Architecture Governance Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad within an Agile/Scrum framework, driving engineering quality and operational rigor. Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align identity roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization policy engines (e.g., Oracle Entitlement Server / OES).Microsoft Ecosystem Collaboration: Partner with M365 and endpoint engineering teams to ensure seamless federation, Primary Refresh Token (PRT) evaluation, Conditional Access handoffs, and frictionless login workflows.2. Operational Reliability & Current Environment Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) across core identity infrastructure, including PingFederate, PingDirectory, and PingID.Workforce & CIAM Integrations: Manage integrations for customer-facing identity (CIAM via PingOne Customer) and support workforce authentication across standard workstations, shared clinical kiosks, and Citrix VDI environments. Application Federation: Onboard and configure clinical information systems (EHR/EMR), custom business applications, and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate service interruptions.3. Modernization & Future Architecture Cloud Workforce Migration: Spearhead the migration of enterprise workforce authentication to PingOne Workforce Cloud and champion cloud-native identity modernization. Standards Enforcement: Champion and enforce enterprise SSO standards ("Configuration over Customization"), establishing strict governance for application onboarding and architecture exception reviews. Legacy Grant Deprecation: Deprecate insecure and legacy authentication methods (e.g., transitioning applications from Resource Owner Password Credentials / ROPC to OAuth 2.0 Authorization Code with PKCE).Identity Orchestration (DaVinci):Architect dynamic identity orchestration journeys using PingOne DaVinci, integrating adaptive risk-based MFA (PingOne Protect) and passwordless authentication (FIDO2, WebAuthn).GCP Cloud DevOps: Advance identity infrastructure automation on Google Cloud Platform (GCP) utilizing Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Kubernetes Engine (GKE).Future Cloud IdP Strategy: Maintain architectural readiness for potential future adoption and integration with cloud identity platforms such as Microsoft Entra ID.Developer Experience: Streamline internal developer onboarding through self-service tools, dynamic JWKS key discovery, and automated CI/CD deployment hooks. Required Qualifications & Experience Professional Experience Total IAM Experience:8+ years of dedicated experience in enterprise Identity & Access Management (IAM) and Single Sign-On (SSO) architecture/engineering. Technical Leadership:2+ years leading engineering squads, mentoring technical staff, and collaborating directly with Enterprise Architecture and Security teams. Enterprise Scale: Proven background maintaining high-availability, mission-critical identity infrastructure in large, regulated environments (healthcare, HIPAA, or financial services experience highly preferred).Technical Competencies Ping Identity Suite & DaVinci Orchestration: Deep engineering expertise with PingFederate, PingID, PingDirectory, Ping Central, and PingOne Workforce Cloud/Customer. Strong hands-on proficiency designing user journeys and orchestration flows in PingOne DaVinci.(Note: PingAccess is not used in this environment).Federation Protocols & Standards: Expert-level mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep practical knowledge of modern grant flows (Authorization Code + PKCE, Token Exchange) and legacy grant remediation. Authorization Concepts: Strong understanding of fine-grained, externalized authorization models (ABAC/PBAC) and integrating modern policy engines (such as PingAuthorize) with enterprise SSO platforms. Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to streamline user login and support long-term cloud identity roadmap initiatives. Endpoint & Session Controls: Experience establishing session policies, Single Logout (SLO), and context-aware MFA rules across managed endpoints, shared frontline/clinical terminals, and virtualized desktops (Citrix VDI).Cloud & DevOps Automation: Direct DevOps and Infrastructure as Code experience on Google Cloud Platform (GCP), including Terraform, Kubernetes (GKE), Docker, CI/CD pipeline automation (GitLab CI / Jenkins), REST APIs, and scripting (Python, Bash, or PowerShell).Preferred Certifications Ping Identity Certified Professional / Architect (PingFederate / PingOne) Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100) Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer Certified Information Systems Security Professional (CISSP) Certified Identity and Access Manager (CIAM)