VIATEQ Corporation is looking for an experienced Identity Federation & PKI Engineer to support our Prime contractor and government customer in Washington, DC. This position is Hybrid. This position requires the candidate to be able to obtain a Public Trust.
The Identity Federation & PKI Engineer serves as a core technical expert responsible for supporting designs from the ICAM Lead, Entra and Okta developers implementing, securing, and maintaining enterprise-wide identity federation frameworks and Public Key Infrastructure (PKI) systems. This role is highly technical, focusing on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication pathways.
Operating within a multi-cloud enterprise ecosystem, the engineer will manage seamless single sign-on (SSO) and lifecycle integration across products such as Ping Identity, Okta, and Microsoft Entra. The ideal candidate possesses deep expertise in modern authentication protocols-specifically OIDC, OAuth, and FIDO-coupled with traditional PKI and PIV/CAC card ecosystem management to drive the agency's Zero Trust Architecture (ZTA) and federal compliance goals.
Responsibilities:
Principal responsibilities will include but are not limited to:
- Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OpenID Connect [OIDC]) across disparate environments, SaaS products, and legacy systems.
- Configure, optimize, and troubleshoot complex identity topologies utilizing Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
- Work close with Entra and Okta team leads to Implement secure API authorization mechanisms and custom token attributes/claims structures using OAuth frameworks.
- Support and implement passwordless and phishing-resistant authentication mechanisms utilizing FIDO2 / WebAuthn standards.
Public Key Infrastructure (PKI) & Credential Engineering
- Manage enterprise certificate lifecycles, including Root/Issuing Certificate Authorities (CAs), registration authorities, and revocation mechanisms (CRLs, OCSP).
- Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers (IdPs) for derived credentials and multi-factor authentication (MFA).
- Maintain the security and cryptographic integrity of PKI hardware security modules (HSMs) and software systems in alignment with federal mandates (FIPS 140-3).
- Troubleshoot complex certificate validation issues, trust chain configurations, and cross-realm trust setups.
- Strong understanding of Azure Key Vault and Key Management Systems
- Strong Understanding of Post Quantum Cryptography
Platform Integration & Lifecycle Management
- Facilitate secure inbound/outbound provisioning pathways (SCIM, Just-In-Time) between Ping, Okta, and Microsoft Entra to ensure unified user profiles.
- Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across all identity platforms.
- Document system architectures, engineering designs, security controls, and deployment cookbooks to ensure standardizable configurations.
DevSecOps & Testing Automation
- Support the automation of federation deployments and infrastructure-as-code (IaC) configuration for identity environments using DevSecOps pipelines - Super Intelligence (SI).
- Develop and execute precise Test Plans and Test Summaries verifying federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.
Required Qualifications:
- U.S. Citizen.
- Bachelor's Degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
- 6-10+ years of engineering experience focused on Identity and Access Management (IAM) and network security.
- Minimum of 4 years of hands-on experience configuring and supporting federated identity solutions and enterprise PKI.
Technical & Professional Skills:
- Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
- Deep, authoritative knowledge of identity protocols: OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
- Hands-on experience with Microsoft Active Directory Certificate Services (ADCS) or commercial PKI software platforms (e.g., DigiCert, Entrust).
- Strong understanding of federal cybersecurity mandates (Executive Order 14028, NIST SP 800-63-3, FICAM profiles).
- Experience with scripting languages (PowerShell, Python, Bash) or API tooling (Postman) to test and automate identity lifecycle functions.
- Analytical ability to decode SAML assertions, OIDC JWT tokens, and trace network/HTTPS handshakes to isolate protocol failures.
Compensation Range:
$150,000 - 190,000. This represents the typical compensation range for this position based on experience, location, and other factors.
VIATEQ offers competitive compensation and a comprehensive benefits package, including medical, dental, and vision insurance, a 401(k) plan, paid time off, 11 paid federal holidays, flexible spending accounts, and a professional development reimbursement.
