Note: The job is a remote job and is open to candidates in USA. Endava is seeking a Senior SSO Architect & Team Lead to lead its SSO engineering squad and serve as the technical authority for enterprise authentication. The role focuses on maintaining highly available federation services, migrating workforce authentication to PingOne Workforce Cloud, and advancing secure identity architecture and automation.
Responsibilities
- Lead, mentor, and technically direct the SSO engineering squad in an Agile/Scrum framework, fostering engineering excellence and operational rigor
- Partner closely with Enterprise Architecture and Security Architects to align SSO roadmaps with enterprise blueprints and represent SSO on Architecture Review Boards (ARB)
- Collaborate with adjacent IAM teams evaluating PingAuthorize and modern IDM/IGA solutions to replace legacy authorization systems (Oracle Entitlement Server / OES)
- Partner with the Microsoft/M365 team to ensure seamless federation, PRT evaluation, Conditional Access handoffs, and a cohesive user experience
- Maintain 24x7 operational reliability and high availability (99.99%+) for enterprise federation infrastructure, including PingFederate, PingDirectory, and PingID
- Manage integrations for PingOne Customer (CIAM) and support enterprise workforce authentication across dedicated endpoints, shared clinical kiosks, and Citrix VDI
- Onboard and support core clinical applications (CWOW, HWOW, PATH, Epic, Cerner) and enterprise SaaS platforms using SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC)
- Standardize and automate cryptographic certificate management, token signing, and encryption keys to eliminate unplanned outages
- Lead the active migration of workforce authentication to PingOne Workforce Cloud and drive cloud-native identity modernization
- Champion and enforce Client SSO Enterprise Standards ('Configuration over Customization'), establishing strict governance for application onboarding and exception reviews
- Deprecate legacy authentication methods and eliminate insecure grants (e.g., migrating applications off Resource Owner Password Credentials / ROPC to OAuth 2.0 Auth Code with PKCE)
- Architect dynamic identity orchestration workflows and user journeys using PingOne DaVinci, integrating adaptive MFA (PingOne Protect), risk signals, and passwordless authentication (FIDO2, WebAuthn)
- Drive GCP DevOps automation for identity services, leveraging Infrastructure as Code (Terraform), CI/CD pipelines, and containerized deployments on Google Cloud (GKE)
- Maintain architectural readiness for potential future adoption of cloud identity platforms such as Microsoft Entra ID
- Streamline developer onboarding through self-service tools, dynamic JWKS key discovery, and CI/CD automation
Skills
- 8+ years of dedicated experience in Identity & Access Management (IAM) and enterprise Single Sign-On (SSO) engineering
- 2+ years of experience leading engineering squads, mentoring developers, and partnering with Enterprise Architecture and Security Architecture groups
- Proven track record supporting high-availability, mission-critical environments
- Deep expertise in PingFederate, PingID, PingDirectory, PingCentral, PingOne Workforce Cloud, PingOne Customer (CIAM), and strong hands-on skills in PingOne DaVinci for identity orchestration and flow design
- Solid understanding of fine-grained authorization (ABAC/PBAC) and how modern externalized authorization platforms (e.g., PingAuthorize) integrate with SSO to replace legacy policy engines (OES)
- Expert mastery of SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), JWT, and SCIM; deep knowledge of modern grant flows (Auth Code + PKCE, Token Exchange) and legacy grant remediation
- Strong familiarity with Microsoft 365 federation, Hybrid Identity, and Microsoft Entra ID (Azure AD) concepts (Conditional Access, Intune, PRT) to optimize user login flows and assess future cloud IdP opportunities
- Experience designing session policies, Single Logout (SLO), and MFA rules for corporate laptops, shared clinical workstations, and Citrix VDI
- Strong hands-on DevOps expertise in Google Cloud Platform (GCP), including Infrastructure as Code (Terraform), Kubernetes (GKE), Docker, CI/CD pipeline automation (Jenkins/GitLab CI), REST APIs, and scripting (Python, PowerShell, Bash)
- Balances rigorous security controls with frictionless clinical and teammate user workflows
- Effectively translates enterprise architectural blueprints into technical implementations and communicates clearly across all levels
- Dedicated to developing engineering talent and fostering a culture of technical excellence
- Healthcare and HIPAA compliance experience
- Ping Identity Certified Professional / Architect (PingFederate / PingOne)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300) / Cybersecurity Architect Expert (SC-100)
- Google Cloud Certified: Professional Cloud DevOps Engineer / Cloud Security Engineer
- Certified Information Systems Security Professional (CISSP)
- Certified Identity and Access Manager (CIAM)
Benefits
- Share plan
- Company performance bonuses
- Value-based recognition awards
- Referral bonus
- Career coaching
- Global career opportunities
- Non-linear career paths
- Internal development programmes for management and technical leadership
- Complex projects
- Rotations
- Internal tech communities
- Training
- Certifications
- Coaching
- Online learning platform subscriptions
- Pass-it-on sessions
- Workshops
- Conferences
- Hybrid work and flexible working hours
- Employee assistance programme
- Global internal wellbeing programme
- Access to wellbeing apps
- Hobby clubs and interest groups
- Inclusion and diversity programmes
- Events and celebrations
- For full-time US roles only (not contractor positions): Medical, Dental, vision, Disability coverage, and various other benefit options
- For full-time US roles only (not contractor positions): Flexible Spending Accounts (Medical, Transit, and Dependent Care)
- For full-time US roles only (not contractor positions): Employer Paid Life Insurance and AD&D Coverages
- For full-time US roles only (not contractor positions): Health Savings account paired with the low-cost High Deductible Medical Plan
- For full-time US roles only (not contractor positions): 401(k) Safe Harbor Retirement plan with employer match and immediate vesting
Company Overview
Company H1B Sponsorship