Sr. SSO Architect & Team Lead

Job Title Sr. SSO Architect & Team Lead -  Duration 9 - 12 Months Start Date ASAP Location Denver, CO (Remote)

We are seeking an experienced, forward-thinking Senior SSO Architect & Team Lead to direct our Single Sign-On engineering squad and serve as the technical authority for enterprise authentication. In this role, you will maintain high availability for our core Ping federation environment, lead our active migration to Ping One Workforce Cloud, and partner across architecture and security teams to build a modern, Zero Trust authentication ecosystem for 70,000+ corporate and clinical teammates across the Village.

• Squad Leadership:
  Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor.
• Architecture Alignment:
  Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB).
• Authorization Modernization:
  Collaborate with adjacent IAM teams evaluating Ping Authorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES).
• Microsoft Ecosystem
  
  Collaboration:
  
  Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience.

• Tier-0 High Availability:
  Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including Ping Federate, Ping Directory, and PingID.
• Workforce & CIAM Integrations:
  Manage integrations for Ping One Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI.
• Application Federation:
  Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC).
• Certificate & Key Lifecycle:
  Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages.

• Cloud Workforce Migration:
  Lead the active migration of workforce authentication to Ping One Workforce Cloud and drive cloud-native identity modernization.
• Standards Enforcement:
  Champion and enforce DaVita SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews.
• Legacy Grant Deprecation:
  Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE).
• Identity Orchestration (DaVinci):
  Architect dynamic identity orchestration workflows and user journeys using Ping One DaVinci, integrating adaptive MFA (Ping One Protect), risk signals, and passwordless authentication (FIDO2, Web Authn).
• GCP Cloud Dev Ops:
  Drive GCP Dev Ops automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE).
• Future Cloud IdP Readiness:
  Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra .
• Developer
  
  Experience:
  
  Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation.

• Total
  
  Experience:
  
  8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering.
• Technical Leadership: 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups.
• Enterprise Scale:
  Proven track record supporting high-availability, mission-critical environments (healthcare and HIPAA compliance experience preferred).

• Ping Identity & DaVinci Orchestration:
  Deep expertise in Ping Federate, PingID, Ping Directory, Ping Central, Ping One Workforce Cloud, Ping One Customer (CIAM), and strong hands-on skills in Ping One DaVinci for identity orchestration and flow design. (
  
  Note:
  
  Ping Access is not used in this environment).
• Authorization & Identity Modernization:
  Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized…