Senior SSO Implementation Engineer

Senior SSO Implementation Engineer (8–10+ years)

Location: Chandigarh, India Experience: 8–10+ years

Role summary

You will own end-to-end SSO implementations and federation architecture for large, complex customers — from discovery and design to delivery, automation, and operational handover. You'll act as the technical lead for SSO/IAM projects, collaborate with solution architects and product teams, and drive best practices across security, scalability, and reliability.

Key responsibilities

· Architect, lead and deliver enterprise SSO/federation projects using SAML, OAuth2, OpenID Connect, WS-Federation and SCIM.

· Design integration patterns for cloud (SaaS) apps, legacy on-prem apps, microservices and APIs.

· Implement and configure IdPs/SPs (Okta, Azure AD, Ping, ForgeRock, Keycloak, OneLogin, etc.) and customize integrations when needed.

· Lead complex migrations (legacy SSO → modern OIDC/OAuth or cloud IdP migrations) with zero/low downtime.

· Build reusable templates, automation, and runbooks for onboarding apps (SAML metadata, certificate rotation, attribute mapping, SCIM provisioning).

· Integrate SSO with API gateways, reverse proxies and WAFs (NGINX, HAProxy, Apigee, Kong, AWS API Gateway).

· Implement authentication/authorization flows for web, mobile and APIs, including OAuth2 grant types, JWT validation, token lifecycles and refresh strategies.

· Own certificate and PKI lifecycle management for SSO components.

· Develop automation (Terraform, Ansible, CloudFormation) for IaC, deployment pipelines, and environment provisioning.

· Troubleshoot complex auth failures, perform root cause analysis, and implement fixes; provide L2/L3 handover with documentation.

· Define security standards (token encryption, key rotation, session management), run threat/risk assessments and ensure compliance (SOC2, ISO27001, GDPR where applicable).

· Mentor junior engineers, run knowledge sessions, and perform code/config reviews.

· Engage with customers and presales for scoping, estimates, and technical proposals.

Must-have technical skills & experience

· 8–10+ years in IAM/SSO/Authentication engineering with multiple full lifecycle SSO projects.

· Deep, hands-on experience with SAML 2.0, OAuth2, OpenID Connect, WS-Federation and SCIM.

· Proven experience implementing/configuring major IdPs: Okta, Azure AD, Ping, ForgeRock, Keycloak, OneLogin (any 2+ in depth).

· Strong experience integrating SSO with SaaS (Office365, Salesforce, Google Workspace), custom web apps (.NET/Java/Node), and mobile apps.

· Solid programming/scripting skills: Python, PowerShell, Java, C#, or — used for automation or custom adapters.

· Automation & IaC: Terraform, Powershell, Ansible, CloudFormation (production use).

· Cloud: architecture & implementation experience on AWS, Azure or GCP (at least one).

· Web/API security fundamentals: JWT, JWKs, OAuth token flows, CSRF, cookie/session security, TLS, cert management.

· Directory services and provisioning: Active Directory, LDAP.

· Debugging and observability: logs/traces with Splunk/ELK, metrics with Prometheus/Grafana.

· CI/CD: Jenkins, GitLab CI, or GitHub Actions.

· Experience with containers and orchestration: Docker, Kubernetes (deploying IdP or gateway components).

· Strong stakeholder management, client-facing skills, and ability to lead technical discussions.

Nice-to-have / Preferred

· Hands-on with identity governance (SailPoint, Saviynt) or entitlement management.

· Experience with API gateways (Apigee, Kong) and service mesh patterns.

· Familiarity with PKI solutions and HSMs for key management.

· Certifications: CISSP, CCSP, Okta Certified, Azure AD/Microsoft Identity certifications, ForgeRock or Ping certs.

· Prior exposure to compliance audits (SOC2/ISO) and security assessment tools (Burp Suite, Nessus).

Job Type: Full-time

Pay: ₹276, ₹1,173,403.26 per year

Work Location: In person