IT Systems Administrator SSO IV

Sysazzle • Denver, CO

3d • Remote

About The Position

The IT Systems Administrator will serve as the senior technical authority for enterprise authentication and lead the SSO engineering squad. The role maintains high availability for the Ping federation environment, leads migration to PingOne Workforce Cloud, and partners with architecture and security teams to develop a modern Zero Trust authentication ecosystem for more than 70,000 corporate and clinical teammates.

The position combines technical leadership, operational reliability, and identity modernization. Responsibilities include governing SSO architecture, supporting mission-critical federation and application integrations, automating certificate and key lifecycle management, enforcing enterprise SSO standards, modernizing authorization and authentication flows, and driving identity-service DevOps automation on Google Cloud. The role also designs identity orchestration workflows using PingOne DaVinci and supports developer self-service and future cloud identity readiness.

Requirements

• At least 8 years of dedicated experience in IAM and enterprise SSO engineering.
• At least 2 years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
• Proven experience supporting high-availability, mission-critical environments.
• Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, and PingOne Customer (CIAM), with hands-on PingOne DaVinci identity orchestration and flow-design skills.
• Solid understanding of fine-grained authorization (ABAC/PBAC) and integration of externalized authorization platforms such as PingAuthorize with SSO to replace legacy policy engines.
• Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect, JWT, and SCIM; deep knowledge of Authorization Code with PKCE, Token Exchange, and legacy grant remediation.
• Familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID concepts including Conditional Access, Intune, and PRT.
• Experience designing session policies, Single Logout, and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.
• Hands-on GCP DevOps expertise, including Terraform, Kubernetes/GKE, Docker, CI/CD automation with Jenkins or GitLab CI, REST APIs, and scripting with Python, PowerShell, or Bash.
• Ability to balance rigorous security controls with efficient clinical and teammate workflows.
• Ability to translate enterprise architecture into technical implementations and communicate across organizational levels.
• Ability and commitment to coach engineering talent and foster technical excellence.

Nice To Haves

• Healthcare and HIPAA compliance experience.
• Ping Identity Certified Professional or Architect certification (PingFederate/PingOne).
• Microsoft Certified: Identity and Access Administrator Associate (SC-300) or Cybersecurity Architect Expert (SC-100).
• Google Cloud Certified: Professional Cloud DevOps Engineer or Cloud Security Engineer.
• CISSP certification.
• Certified Identity and Access Manager (CIAM) certification.

Responsibilities

• Lead, mentor, and technically direct the SSO engineering squad within an Agile/Scrum framework.
• Partner with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards.
• Collaborate with IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems such as Oracle Entitlement Server (OES).
• Partner with the Microsoft/M365 team on federation, PRT evaluation, Conditional Access handoffs, and user experience.
• Maintain 24x7 operational reliability and 99.99%+ availability for PingFederate, PingDirectory, and PingID infrastructure.
• Manage PingOne Customer (CIAM) integrations and support workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
• Onboard and support clinical applications and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect.
• Standardize and automate cryptographic certificate management, token signing, and encryption keys to prevent unplanned outages.
• Lead migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
• Enforce SSO enterprise standards, application onboarding governance, and exception reviews.
• Deprecate legacy authentication methods and migrate applications from insecure grants such as ROPC to OAuth 2.0 Authorization Code with PKCE.
• Architect identity orchestration workflows and user journeys in PingOne DaVinci, integrating adaptive MFA, risk signals, and passwordless authentication.
• Drive GCP DevOps automation for identity services using Infrastructure as Code, CI/CD pipelines, and containerized deployments.
• Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.
• Improve developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.

Benefits

• Health benefits
• 401K Plan

What This Job Offers

• Career Level: Senior
• Education Level: No Education Listed