Identity Federation & PKI Engineer (Hybrid)

Koniag Government Services, LLC•Washington, DC

4d•$150,000 - $190,000•Hybrid

About The Position

Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking an experienced Identity Federation & PKI Engineer to support enterprise identity and access management operations for a federal government client in Washington, D.C. This hybrid role requires the ability to obtain and maintain a Public Trust. The engineer is a core technical expert who supports designs from the ICAM Lead and works with Entra and Okta developers to implement, secure, and maintain enterprise identity federation frameworks and PKI systems. The role focuses on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication in a multi-cloud enterprise ecosystem. It supports single sign-on and lifecycle integration across Ping Identity, Okta, and Microsoft Entra, as well as the agency’s Zero Trust Architecture and federal compliance goals.

Requirements

U.S. citizen.
Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
6–10+ years of engineering experience focused on Identity and Access Management and network security.
At least 4 years of hands-on experience configuring and supporting federated identity solutions and enterprise PKI.
Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
Deep knowledge of OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
Hands-on experience with Microsoft Active Directory Certificate Services or commercial PKI platforms such as DigiCert or Entrust.
Strong understanding of federal cybersecurity mandates, including Executive Order 14028, NIST SP 800-63-3, and FICAM profiles.
Experience with PowerShell, Python, or Bash scripting, or API tools such as Postman, to test and automate identity lifecycle functions.
Ability to analyze SAML assertions and OIDC JWT tokens and trace network/HTTPS handshakes to isolate protocol failures.
Ability to obtain and maintain a Public Trust.

Nice To Haves

Strong understanding of Azure Key Vault and Key Management Systems.
Strong understanding of Post Quantum Cryptography.

Responsibilities

Design, build, and maintain enterprise federation connections using SAML, OAuth 2.0, and OIDC across disparate environments, SaaS products, and legacy systems.
Configure, optimize, and troubleshoot identity topologies using Ping Identity products, Okta Identity Cloud, and Microsoft Entra.
Work with Entra and Okta team leads to implement secure API authorization mechanisms and custom token attributes and claims using OAuth frameworks.
Support and implement passwordless and phishing-resistant authentication using FIDO2 and WebAuthn.
Manage enterprise certificate lifecycles, including Root and Issuing Certificate Authorities, registration authorities, and revocation mechanisms such as CRLs and OCSP.
Engineer integration pathways between federal PKI, including PIV/CAC cards, and modern cloud identity providers for derived credentials and MFA.
Maintain the security and cryptographic integrity of PKI hardware security modules and software systems in alignment with FIPS 140-3.
Troubleshoot certificate validation issues, trust-chain configurations, and cross-realm trust setups.
Facilitate secure inbound and outbound provisioning pathways, including SCIM and Just-In-Time provisioning, among Ping, Okta, and Microsoft Entra.
Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across identity platforms.
Document system architectures, engineering designs, security controls, and deployment cookbooks for standardized configurations.
Support automation of federation deployments and infrastructure-as-code configuration for identity environments using DevSecOps pipelines.
Develop and execute test plans and test summaries covering federation-flow stability, token security, certificate rollouts, and disaster-recovery failover scenarios.