Logo for Quantix, Inc.

Senior SSO Architect & Team Lead

Quantix, Inc.

Role overview

Qualifications

  • 8+ years of dedicated experience in Identity Access Management (IAM) and enterprise Single Sign-On (SSO) engineering
  • 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups
  • Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred)

Responsibilities

  • Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework
  • Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints
  • Maintain 24x7 operational reliability and high availability for enterprise federation infrastructure
  • Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization

Key facts

Hard skills

Other skills

  • Team Leadership
  • Collaboration
  • Governance
  • Communication

About the company

Quantix, Inc. logo

Quantix, Inc.

Staffing & Recruiting

Quantix is an IT workforce management services provider that prioritizes people and purpose for growth. Pioneering the road map for changing the culture in the IT services industry. Quantix believes in unleashing the power of human potential, embracing diversity, and helping people and organizations thrive in reshaping our economy and the world. Quantix is on a mission to set a new standard for business to create a more inclusive reality for individuals and teams by supporting organizations that create the type of workplace where people feel motivated to contribute in a way that fuels bottom-line growth. Since 2002 we've been providing contract, contract-to-hire and direct hire services to a wide range of clients. We provide individual consultants, project management, project teams and executive management placements.

Company details

IndustryStaffing & Recruiting
Company size51 - 200

Links

Website LinkedIn See all jobs

Your match analysis

See how your profile stacks up against this role.

We compared the job requirements to your profile to show where you're strong and where you fall short.

Job description

TITLE: SSO Architect
LOCATION: Remote
TYPE: Contract
LENGTH: Thru the end of 2027+ extensions
RATE: Up to $80/hr W2

Key Responsibilities
1. Team Leadership & Architecture Governance
  • Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
  • Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
  • Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).
  • Microsoft Ecosystem Collaboration: Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.
2. Operational Reliability & Current Environment
  • Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID.
  • Workforce & CIAM Integrations: Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
  • Application Federation: Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
  • Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.
3. Modernization & Future Architecture
  • Cloud Workforce Migration: Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
  • Standards Enforcement: Champion and enforce DaVita SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
  • Legacy Grant Deprecation: Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).
  • Identity Orchestration (DaVinci): Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn).
  • GCP Cloud DevOps: Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).
  • Future Cloud IdP Readiness: Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.
  • Developer Experience: Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.
Required Qualifications & Experience
Experience
  • Total Experience: 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
  • Technical Leadership: 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
  • Enterprise Scale: Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).
Technical Competencies
  • Ping Identity & DaVinci Orchestration: Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design. (Note: PingAccess is not used in this environment).
  • Authorization & Identity Modernization: Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES).
  • Federation Protocols & Standards: Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation.
  • Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities.
  • Endpoints & Session Controls: Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.
  • GCP & Cloud DevOps: Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash).

Preferred Certifications
  • Ping Identity Certified Professional / Architect (PingFederate / PingOne)
  • Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
  • Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
  • Certified Information Systems Security Professional (CISSP)
  • Certified Identity and Access Manager (CIAM)

Apply once. Then go straight to the hiring manager.

After you apply, unlock the direct contact details of the people who actually make the call. A quick follow-up makes you 5x more likely to land an interview.

MR

Marcus Rivera

Chief Revenue Officer

m.rivera@company.com
linkedin.com/in/marcusrivera
Unlocked after you apply
·

Related jobs

United States

Other jobs at Quantix, Inc.

Premium

Reach out to the hiring manager directly.

Gain access to the contact details of the hiring managers who actually decide, and reach out to network with them directly. That, plus more when you upgrade:

  • Full match report with fit score and gaps
  • Career diagnostics on how recruiters read you
  • Curated company matches and warm intros
  • 48h early access to new roles

Cancel anytime.