Security Token Service Engineer (Identity & Access Management(IAM) Eng

ATTENTION MILITARY AFFILIATED JOB SEEKERS - Our organization works with partner companies to source qualified talent for their open roles. The following position is available to Veterans, Transitioning Military, National Guard and Reserve Members, Military Spouses, Wounded Warriors, and their Caregivers. If you have the required skill set, education requirements, and experience, please click the submit button and follow the next steps. All positions are onsite, unless otherwise stated.

Description:
Are you an experienced Identity & Access Management Engineer who enjoys building secure authentication and authorization solutions rather than simply administering existing IAM platforms? Are you interested in developing foundational security services that enable enterprise-wide data connectivity, API integration, and emerging AI capabilities?

Opportunity:
Virtual Service Operations (VSO) is seeking an experienced Identity & Access Management (IAM) Engineer to support a high-visibility enterprise platform modernization initiative.

This initiative is focused on developing reusable software platforms and services that enable secure data connectivity, interoperability, and AI integration across a large, complex enterprise environment.

The project involves building foundational tools and capabilities that allow enterprise applications, databases, and services to securely exchange information through standardized APIs and Model Context Protocol (MCP) servers.

This is not a traditional IAM administration, cloud migration, or infrastructure support role. We are looking for a hands-on engineer who can design, develop, integrate, and operate secure authentication and authorization services in a production environment.

You will play a key role in establishing the identity and security foundation for an enterprise integration platform, including identity federation, token management, credential security, certificate trust, and API authorization enforcement.

Key Responsibilities:

Identity & Authentication Services:

• Design, develop, implement, and maintain authentication and authorization services supporting enterprise applications and APIs.
• Build and operate token services supporting token issuance, exchange, validation, revocation, and introspection.
• Implement secure authentication and authorization flows using OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0.
• Develop and maintain JSON Web Token (JWT) validation and token management capabilities.

• Integrate enterprise identity providers, including Microsoft Entra ID, Active Directory Federation Services (ADFS), and SiteMinder.
• Configure and integrate Keycloak as an identity broker, including realms, clients, identity providers, and protocol mappers.
• Establish secure federation and single sign-on capabilities across enterprise applications and services.
• Troubleshoot complex authentication, federation, and authorization issues.

• Implement authorization enforcement at API gateways using Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectural patterns.
• Develop and integrate secure access controls for APIs, applications, and backend services.
• Support standardized authentication and authorization approaches across distributed enterprise systems.
• Collaborate with platform and software engineering teams to integrate identity services into reusable enterprise capabilities.

• Manage credential and cryptographic key lifecycles, including client secrets, signing keys, rotation, and secure storage.
• Implement and maintain Public Key Infrastructure (PKI) and certificate trust configurations.
• Support X.509 certificates, certificate authority (CA) chains, TLS/mTLS, certificate issuance, renewal, and revocation.
• Apply security best practices to protect service-to-service communications and sensitive credentials.

• Document identity architectures, authentication flows, authorization models, and security integrations.
• Collaborate with cybersecurity, platform engineering, and development teams to ensure secure implementation.
• Support security assessments, technical reviews, audits, and authorization documentation.
• Contribute to scalable, reusable, and maintainable identity security solutions.

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience.
• Minimum of 3 years of hands-on experience in Identity & Access Management engineering, including designing, developing, or implementing authentication and authorization services in production environments.
• Demonstrated experience implementing OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 authentication and federation flows.
• Hands-on experience with token exchange, JWT validation, and token-based authentication.
• Experience integrating at least one enterprise identity provider, such as Microsoft Entra ID, ADFS, or SiteMinder.
• Experience with Keycloak or a comparable identity broker.
• Working knowledge of Public Key Infrastructure (PKI), X.509 certificates, and TLS/mTLS.
• Proficiency developing backend services using Java, Go, Python, or a comparable programming language.
• Strong troubleshooting, technical documentation, and problem-solving skills.
• Ability to collaborate effectively with software engineers, cloud architects, and cybersecurity professionals.

• This is a remote role
• Bachelor’s degree 
• Minimum of 3 years of hands-on experience in Identity & Access Management engineering
• New hires assigned on this project will be required to undergo and pass drug and alcohol tests per our client's contract requirements
• Please note that this specific position requires U.S. citizenship status

• You are an excellent communicator in writing and speaking.
• You have the ability to work independently but also value teamwork.
• Your problem-solving skills are excellent.
• You are looking for a job where performance appraisals occur regularly, and you look forward to advancing your career.
• You seek a community of virtue-centered co-workers and clients.

• Experience extending Keycloak using Service Provider Interfaces (SPIs), custom authenticators, or custom integrations.
• Experience implementing fine-grained authorization using Open Policy Agent (OPA) or comparable policy engines.
• Familiarity with Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectures.
• Experience with AWS Key Management Service (KMS), HashiCorp Vault, Hardware Security Modules (HSMs), or comparable key management technologies.
• Experience securing machine-to-machine communications, service accounts, and automated workloads.
• Familiarity with Model Context Protocol (MCP) and authorization approaches for AI-enabled applications or agents.
• Experience integrating identity and authorization services with API gateways.
• Familiarity with NIST 800-53, NIST 800-63, FedRAMP, or security authorization processes.
• Experience developing security services within AWS or other cloud environments.
• Experience supporting enterprise modernization, platform engineering, or distributed application integration initiatives.