Interested candidates are encouraged to apply as soon as possible.
Koniag Operations Services, LLC (KOS), a Koniag Government Services company, is seeking an experienced Identity Federation & PKI Engineer to support KOS enterprise identity and access management operations for a federal government client located in Washinton D.C. This position the ability to obtain and maintain a Public Trust. This is a Hybrid opportunity.
Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits, and tuition reimbursement.
The Identity Federation & PKI Engineer serves as a core technical expert responsible for supporting designs from the ICAM Lead, Entra and Okta developers implementing, securing, and maintaining enterprise-wide identity federation frameworks and Public Key Infrastructure (PKI) systems. This role is highly technical, focusing on cross-domain identity integration, secure token exchange, and modern phishing-resistant authentication pathways.
Operating within a multi-cloud enterprise ecosystem, the engineer will manage seamless single sign-on (SSO) and lifecycle integration across products such as Ping Identity, Okta, and Microsoft Entra. The ideal candidate possesses deep expertise in modern authentication protocols—specifically OIDC, OAuth, and FIDO—coupled with traditional PKI and PIV/CAC card ecosystem management to drive the agency's Zero Trust Architecture (ZTA) and federal compliance goals.
Principal responsibilities will include but are not limited to:
Design, build, and maintain enterprise federation connections (SAML, OAuth 2.0, OpenID Connect [OIDC]) across disparate environments, SaaS products, and legacy systems.
Configure, optimize, and troubleshoot complex identity topologies utilizing Ping Identity (PingFederate/PingAccess), Okta Identity Cloud, and Microsoft Entra.
Work close with Entra and Okta team leads to Implement secure API authorization mechanisms and custom token attributes/claims structures using OAuth frameworks.
Support and implement passwordless and phishing-resistant authentication mechanisms utilizing FIDO2 / WebAuthn standards.
Public Key Infrastructure (PKI) & Credential Engineering
Manage enterprise certificate lifecycles, including Root/Issuing Certificate Authorities (CAs), registration authorities, and revocation mechanisms (CRLs, OCSP).
Engineer integration pathways between federal PKI (PIV/CAC cards) and modern cloud identity providers (IdPs) for derived credentials and multi-factor authentication (MFA).
Maintain the security and cryptographic integrity of PKI hardware security modules (HSMs) and software systems in alignment with federal mandates (FIPS 140-3).
Troubleshoot complex certificate validation issues, trust chain configurations, and cross-realm trust setups.
Strong understanding of Azure Key Vault and Key Management Systems
Strong Understanding of Post Quantum Cryptography
Platform Integration & Lifecycle Management
Facilitate secure inbound/outbound provisioning pathways (SCIM, Just-In-Time) between Ping, Okta, and Microsoft Entra to ensure unified user profiles.
Configure conditional access policies, risk-based authentication rules, and step-up authentication profiles across all identity platforms.
Document system architectures, engineering designs, security controls, and deployment cookbooks to ensure standardizable configurations.
DevSecOps & Testing Automation
Support the automation of federation deployments and infrastructure-as-code (IaC) configuration for identity environments using DevSecOps pipelines - Super Intelligence (SI).
Develop and execute precise Test Plans and Test Summaries verifying federation flow stability, token security, certificate rollouts, and disaster recovery failover scenarios.
Required Qualifications
U.S. Citizen
Bachelor’s Degree in Cybersecurity, Computer Science, Computer Engineering, Information Technology, or a…