Interested candidates are encouraged to apply as soon as possible.
Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking an experienced
Identity Federation & PKI Engineer to support KOS enterprise identity and access management operations for a federal government client located in Washinton D.C. This position the ability to obtain and maintain a Public Trust. This is a Hybrid opportunity.
Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits, and tuition reimbursement.
The
Identity Federation & PKI Engineer serves as a core technical expert responsible for supporting designs from the ICAM Lead, Entra and Okta developers implementing, securing, and maintaining enterprise-wide identity federation frameworks and Public Key Infrastructure (PKI) systems. This role is highly technical, focusing on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication pathways.
Operating within a multi-cloud enterprise ecosystem, the engineer will manage seamless single sign-on (SSO) and lifecycle integration across products such as
Ping Identity, Okta, and Microsoft Entra. The ideal candidate possesses deep expertise in modern authentication protocols-specifically
OIDC, OAuth, and FIDO-coupled with traditional
PKI and PIV/CAC card ecosystem management to drive the agency's Zero Trust Architecture (ZTA) and federal compliance goals.
Principal responsibilities will include but are not limited to:
- Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OpenID Connect [OIDC]) across disparate environments, SaaS products, and legacy systems.
- Configure, optimize, and troubleshoot complex identity topologies utilizing Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
- Work close with Entra and Okta team leads to Implement secure API authorization mechanisms and custom token attributes/claims structures using OAuth frameworks.
- Support and implement passwordless and phishing-resistant authentication mechanisms utilizing FIDO2 / WebAuthn standards.
Public Key Infrastructure (PKI) & Credential Engineering- Manage enterprise certificate lifecycles, including Root/Issuing Certificate Authorities (CAs), registration authorities, and revocation mechanisms (CRLs, OCSP).
- Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers (IdPs) for derived credentials and multi-factor authentication (MFA).
- Maintain the security and cryptographic integrity of PKI hardware security modules (HSMs) and software systems in alignment with federal mandates (FIPS 140-3).
- Troubleshoot complex certificate validation issues, trust chain configurations, and cross-realm trust setups.
- Strong understanding of Azure Key Vault and Key Management Systems
- Strong Understanding of Post Quantum Cryptography
Platform Integration & Lifecycle Management- Facilitate secure inbound/outbound provisioning pathways (SCIM, Just-In-Time) between Ping, Okta, and Microsoft Entra to ensure unified user profiles.
- Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across all identity platforms.
- Document system architectures, engineering designs, security controls, and deployment cookbooks to ensure standardizable configurations.
DevSecOps & Testing Automation- Support the automation of federation deployments and infrastructure-as-code (IaC) configuration for identity environments using DevSecOps pipelines - Super Intelligence (SI).
- Develop and execute precise Test Plans and Test Summaries verifying federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.
Required Qualifications- U.S. Citizen
- Bachelor's Degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
- 6-10+ years of engineering experience focused on Identity and Access Management (IAM) and network security.
- Minimum of 4 years of hands-on experience configuring and supporting federated identity solutions and enterprise PKI.
Technical & Professional Skills- Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
- Deep, authoritative knowledge of identity protocols: OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
- Hands-on experience with Microsoft Active Directory Certificate Services (ADCS) or commercial PKI software platforms (e.g., DigiCert, Entrust).
- Strong understanding of federal cybersecurity mandates (Executive Order 14028, NIST SP 800-63-3, FICAM profiles).
- Experience with scripting languages (PowerShell, Python, Bash) or API tooling (Postman) to test and automate identity lifecycle functions.
- Analytical ability to decode SAML assertions, OIDC JWT tokens, and trace network/HTTPS handshakes to isolate protocol failures.
