Identity Federation & PKI Engineer (Hybrid)

VIATEQ Corporation is looking for an experienced Identity Federation & PKI Engineer to support our Prime contractor and government customer in Washington, DC. This position is Hybrid. This position requires the candidate to be able to obtain a Public Trust.

The Identity Federation & PKI Engineer serves as a core technical expert responsible for supporting designs from the ICAM Lead, Entra and Okta developers implementing, securing, and maintaining enterprise-wide identity federation frameworks and Public Key Infrastructure (PKI) systems. This role is highly technical, focusing on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication pathways.

Operating within a multi-cloud enterprise ecosystem, the engineer will manage seamless single sign-on (SSO) and lifecycle integration across products such as Ping Identity, Okta, and Microsoft Entra. The ideal candidate possesses deep expertise in modern authentication protocols—specifically OIDC, OAuth, and FIDO—coupled with traditional PKI and PIV/CAC card ecosystem management to drive the agency's Zero Trust Architecture (ZTA) and federal compliance goals.

Responsibilities

Principal responsibilities will include but are not limited to:

• Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OpenID Connect [OIDC]) across disparate environments, SaaS products, and legacy systems.
• Configure, optimize, and troubleshoot complex identity topologies utilizing Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
• Work close with Entra and Okta team leads to Implement secure API authorization mechanisms and custom token attributes/claims structures using OAuth frameworks.
• Support and implement passwordless and phishing-resistant authentication mechanisms utilizing FIDO2 / WebAuthn standards.

Public Key Infrastructure (PKI) & Credential Engineering

• Manage enterprise certificate lifecycles, including Root/Issuing Certificate Authorities (CAs), registration authorities, and revocation mechanisms (CRLs, OCSP).
• Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers (IdPs) for derived credentials and multi-factor authentication (MFA).
• Maintain the security and cryptographic integrity of PKI hardware security modules (HSMs) and software systems in alignment with federal mandates (FIPS 140-3).
• Troubleshoot complex certificate validation issues, trust chain configurations, and cross-realm trust setups.
• Strong understanding of Azure Key Vault and Key Management Systems
• Strong Understanding of Post Quantum Cryptography

Platform Integration & Lifecycle Management

• Facilitate secure inbound/outbound provisioning pathways (SCIM, Just-In-Time) between Ping, Okta, and Microsoft Entra to ensure unified user profiles.
• Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across all identity platforms.
• Document system architectures, engineering designs, security controls, and deployment cookbooks to ensure standardizable configurations.

DevSecOps & Testing Automation

• Support the automation of federation deployments and infrastructure-as-code (IaC) configuration for identity environments using DevSecOps pipelines - Super Intelligence (SI).
• Develop and execute precise Test Plans and Test Summaries verifying federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.

Required Qualifications

• U.S. Citizen.
• Bachelor’s Degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a related field.
• 6–10+ years of engineering experience focused on Identity and Access Management (IAM) and network security.
• Minimum of 4 years of hands-on experience configuring and supporting federated identity solutions and enterprise PKI.

Technical & Professional Skills

• Advanced engineering proficiency with Ping Identity product suites, Okta, and Microsoft Entra.
• Deep, authoritative knowledge of identity protocols: OIDC, OAuth 2.0, SAML 2.0, and FIDO/WebAuthn.
• Hands-on experience with Microsoft Active Directory Certificate Services (ADCS) or commercial PKI software platforms (e.g., DigiCert, Entrust).
• Strong understanding of federal cybersecurity mandates (Executive Order 14028, NIST SP 800-63-3, FICAM profiles).
• Experience with scripting languages (PowerShell, Python, Bash) or API tooling (Postman) to test and automate identity lifecycle functions.
• Analytical ability to decode SAML assertions, OIDC JWT tokens, and trace network/HTTPS handshakes to isolate protocol failures.

Compensation Range

$150,000 – 190,000. This represents the typical compensation range for this position based on experience, location, and other factors.

About VIATEQ

VIATEQ is a proactive provider of collaborative solutions for federal government agencies. Our collaborative service framework and flexibility allow employees, customers, and business partners to work together successfully anywhere, anytime. VIATEQ’s service areas also allow government agencies to respond to competitive pressures and achieve new performance levels.

VIATEQ offers competitive compensation and a comprehensive benefits package, including medical, dental, and vision insurance, a 401(k) plan, paid time off, 11 paid federal holidays, flexible spending accounts, and a professional development reimbursement.

Equal Opportunity Statement

VIATEQ provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination, harassment, and retaliation in accordance with applicable federal, state, and local laws. This policy applies to all terms and conditions of employment including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation, and training.