Identity Federation & PKI Engineer (Hybrid)

Koniag Government Services•Washington, DC

3d•Hybrid

About The Position

Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking an experienced Identity Federation & PKI Engineer to support enterprise identity and access management operations for a federal government client in Washington, D.C. This hybrid position requires the ability to obtain and maintain a Public Trust. The engineer is a core technical expert who supports designs from the ICAM Lead and works with Entra and Okta developers to implement, secure, and maintain enterprise identity federation frameworks and Public Key Infrastructure (PKI) systems. The role focuses on cross-domain identity integration, secure token exchange, and phishing-resistant authentication across a multi-cloud environment. The engineer supports single sign-on and lifecycle integration using Ping Identity, Okta, and Microsoft Entra, while advancing Zero Trust Architecture and federal compliance goals. The position includes designing federation connections, managing certificate lifecycles and PKI integrations, supporting identity provisioning and access policies, documenting architectures and controls, and assisting with deployment automation and testing.

Requirements

U.S. citizenship.
Bachelor’s degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
6–10+ years of engineering experience focused on Identity and Access Management and network security.
At least 4 years of hands-on experience configuring and supporting federated identity solutions and enterprise PKI.
Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
Deep knowledge of OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
Hands-on experience with Microsoft Active Directory Certificate Services (ADCS) or commercial PKI software platforms such as DigiCert or Entrust.
Strong understanding of federal cybersecurity mandates, including Executive Order 14028, NIST SP 800-63-3, and FICAM profiles.
Experience with PowerShell, Python, or Bash scripting, or API tooling such as Postman, to test and automate identity lifecycle functions.
Ability to decode SAML assertions and OIDC JWT tokens and trace network/HTTPS handshakes to isolate protocol failures.
Ability to obtain and maintain a Public Trust.

Nice To Haves

Strong understanding of Azure Key Vault and Key Management Systems.
Strong understanding of post-quantum cryptography.

Responsibilities

Design, build, maintain, optimize, and troubleshoot enterprise federation connections and identity topologies across disparate environments, SaaS products, and legacy systems.
Configure and support Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
Work with Entra and Okta team leads to implement secure API authorization mechanisms and custom token attributes and claims using OAuth frameworks.
Support and implement passwordless and phishing-resistant authentication using FIDO2 and WebAuthn.
Manage enterprise certificate lifecycles, including Root and Issuing Certificate Authorities, registration authorities, and revocation mechanisms such as CRLs and OCSP.
Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers for derived credentials and multi-factor authentication.
Maintain the security and cryptographic integrity of PKI hardware security modules and software systems in alignment with federal mandates.
Troubleshoot certificate validation issues, trust chain configurations, and cross-realm trust setups.
Facilitate secure inbound and outbound provisioning pathways, including SCIM and Just-In-Time provisioning, among Ping, Okta, and Microsoft Entra.
Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across identity platforms.
Document system architectures, engineering designs, security controls, and deployment cookbooks.
Support automation of federation deployments and infrastructure-as-code configuration for identity environments using DevSecOps pipelines.
Develop and execute test plans and test summaries covering federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.