Principal SSO Architect & Identity Lead

As the Principal SSO Architect & Identity Lead, you will direct the Single Sign-On engineering squad and serve as the technical authority for enterprise authentication . You will maintain high availability for core Ping federation services, lead the cloud migration to PingOne Workforce Cloud, and architect a modern Zero Trust identity ecosystem for 70,000+ teammates across corporate, clinical, and VDI environments .

• Squad Leadership & Governance: Lead and mentor the SSO engineering squad in an Agile framework, align roadmaps with Enterprise Architecture, and represent SSO on Architecture Review Boards (ARB) .

• Tier-0 High Availability: Ensure 99.99%+ availability for enterprise federation infrastructure (PingFederate, PingDirectory, PingID, and PingOne CIAM) across clinical systems (Epic, Cerner, CWOW) and SaaS platforms .

• Cloud Modernization & Orchestration: Lead migration to PingOne Workforce Cloud, deprecate legacy grants (ROPC to OAuth 2.0 Auth Code with PKCE), and architect dynamic user journeys using PingOne DaVinci and adaptive MFA .

• Google Cloud Platform Cloud DevOps: Automate identity infrastructure deployment using Infrastructure as Code (Terraform), Kubernetes (GKE), and CI/CD pipelines on Google Cloud Platform .

• Federation & Authorization Alignment: Partner with Microsoft/M365 teams on hybrid federation/Entra ID integration and evaluate modern authorization platforms (PingAuthorize) .

• Experience: 8+ years in dedicated IAM/SSO engineering, with 2+ years leading engineering squads in enterprise healthcare or regulated environments .

• Ping Identity Suite: Deep mastery of PingFederate, PingDirectory, PingID, PingOne Workforce/CIAM, and PingOne DaVinci .

• Protocols & Standards: Expert-level SAML 2.0, OAuth 2.0, OIDC, JWT, SCIM, FIDO2/WebAuthn, and fine-grained authorization (ABAC/PBAC) .

• Cloud & DevOps: Hands-on Google Cloud Platform DevOps expertise (Terraform, GKE, Docker, CI/CD pipelines) and scripting proficiency (Python, PowerShell, Bash) .

• Preferred Certifications: Ping Identity Certified Architect, CISSP, SC-300 / SC-100, or Google Cloud Platform Professional Cloud Security Engineer