Company Description
Technology is our how. And people are our why. For over two decades, we have been harnessing technology to drive meaningful change.
By combining world-class engineering, industry expertise and a people-centric mindset, we consult and partner with leading brands from various industries to create dynamic platforms and intelligent digital experiences that drive innovation and transform businesses.
From prototype to real-world impact - be part of a global shift by doing work that matters.
Job Description
We are seeking an experienced, forward-thinking Senior SSO Architect & Team Lead to direct our Single Sign-On engineering squad and serve as the technical authority for enterprise authentication. In this role, you will maintain high availability for our core Ping federation environment, lead our active migration to PingOne Workforce Cloud, and partner across architecture and security teams to build a modern, Zero Trust authentication ecosystem for 70,000+ corporate and clinical teammates across the Village.
Key Responsibilities
1. Team Leadership & Architecture Governance
- Squad Leadership: Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
- Architecture Alignment: Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
- Authorization Modernization: Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).
- Microsoft Ecosystem Collaboration: Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.
2. Operational Reliability & Current Environment
- Tier-0 High Availability: Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID.
- Workforce & CIAM Integrations: Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
- Application Federation: Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
- Certificate & Key Lifecycle: Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.
3. Modernization & Future Architecture
- Cloud Workforce Migration: Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization.
- Standards Enforcement: Champion and enforce Client SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
- Legacy Grant Deprecation: Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).
- Identity Orchestration (DaVinci): Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn).
- GCP Cloud DevOps: Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).
- Future Cloud IdP Readiness: Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID.
- Developer Experience: Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.
Qualifications
- Total Experience: 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
- Technical Leadership: 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
- Enterprise Scale: Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).
Technical Competencies
- Ping Identity & DaVinci Orchestration: Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design. (Note: PingAccess is not used in this environment).
- Authorization & Identity Modernization: Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES).
- Federation Protocols & Standards: Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation.
- Microsoft Federation & Cloud Identity: Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities.
- Endpoints & Session Controls: Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI.
- GCP & Cloud DevOps: Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash).
Core Soft Skills
- Strategic Problem Solver: Balances rigorous security controls with frictionless clinical and teammate user workflows.
- Collaborative Communicator: Effectively translates enterprise architectural blueprints into technical implementations and communicates clearly across all levels.
- Team Coach: Dedicated to developing engineering talent and fostering a culture of technical excellence.
Preferred Certifications
- Ping Identity Certified Professional / Architect (PingFederate / PingOne)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
- Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
- Certified Information Systems Security Professional (CISSP)
- Certified Identity and Access Manager (CIAM)
Additional Information
Discover some of the global benefits that empower our people to become the best version of themselves:
- Finance: Competitive salary package, share plan, company performance bonuses, value-based recognition awards, referral bonus;
- Career Development: Career coaching, global career opportunities, non-linear career paths, internal development programmes for management and technical leadership;
- Learning Opportunities: Complex projects, rotations, internal tech communities, training, certifications, coaching, online learning platforms subscriptions, pass-it-on sessions, workshops, conferences;
- Work-Life Balance: Hybrid work and flexible working hours, employee assistance programme;
- Health: Global internal wellbeing programme, access to wellbeing apps;
- Community: Global internal tech communities, hobby clubs and interest groups, inclusion and diversity programmes, events and celebrations.
Additional Employee Requirements
- Participation in both internal meetings and external meetings via video calls, as necessary.
- Ability to go into corporate or client offices to work onsite, as necessary.
- Prolonged periods of remaining stationary at a desk and working on a computer, as necessary.
- Ability to bend, kneel, crouch, and reach overhead, as necessary.
- Hand-eye coordination necessary to operate computers and various pieces of office equipment, as necessary.
- Vision abilities including close vision, toleration of fluorescent lighting, and adjusting focus, as necessary.
- For positions that require business travel and/or event attendance, ability to lift 25 lbs, as necessary.
- For positions that require business travel and/or event attendance, a valid driver’s license and acceptable driving record are required, as driving is an essential job function.
*If requested, reasonable accommodations will be made to enable employees requiring accommodations to perform the essential functions of their jobs, absent undue hardship.
USA Benefits (Full time roles only, does not apply to contractor positions)
- Robust healthcare and benefits including Medical, Dental, vision, Disability coverage, and various other benefit options
- Flexible Spending Accounts (Medical, Transit, and Dependent Care)
- Employer Paid Life Insurance and AD&D Coverages
- Health Savings account paired with our low-cost High Deductible Medical Plan
- 401(k) Safe Harbor Retirement plan with employer match with immediately vest
At Endava, we’re committed to creating an open, inclusive, and respectful environment where everyone feels safe, valued, and empowered to be their best. We welcome applications from people of all backgrounds, experiences, and perspectives—because we know that inclusive teams help us deliver smarter, more innovative solutions for our customers. Hiring decisions are based on merit, skills, qualifications, and potential. If you need adjustments or support during the recruitment process, please let us know.
