Cloud Identity and Security Engineer

Key Responsibilities

• Authentication & Identity Engine Management (BYOI):
• Administering identity federation and user authentication workflows across PingFederate and Keycloak.
• Integrating multi-factor authentication (MFA) and Single Sign-On (SSO) protocols (SAML 2.0, OIDC) between enterprise identity providers and cloud services.
• Provisioning and maintaining user accounts, group assignments, and directory memberships across identity platforms.
• Authorization & Access Control (AWS & GitLab):
• Managing fine-grained permission models, roles, and group memberships within AWS IAM Identity Center (IDC) and GitLab repositories/groups.
• Implementing and maintain landing zone configuration changes through AWS Landing Zone Accelerator (LZA) to enforce organizational boundary policies and Service Control Policies (SCPs).
• Enforcing Least Privilege access models across AWS CodeCommit, development repositories, and cloud workloads.
• Secrets Management & Accounting:
• Configuring and maintain key-value secrets, database credentials, and API keys within AWS Secrets Manager, ensuring automated rotation and secure access policies.
• Auditing identity lifecycle workflows, repository permissions, and access logs to ensure compliance with security baselines.
• Infrastructure as Code (IaC) & Automation:
• Codifying identity resources, group definitions, access policies, and cloud infrastructure using Terraform.
• Automating user onboarding/offboarding pipelines and permission requests across GitLab, AWS, and PingFederate/Keycloak.
• 2+ years of hands-on experience in cloud identity management, IAM, or cloud infrastructure operations.
• Practical knowledge of federated identity concepts (SAML, OIDC), PingFederate, Keycloak, and AWS IAM Identity Center (IDC).
• Strong proficiency with Terraform for provisioning cloud resources, IAM policies, and identity group memberships.
• Hands-on experience managing permissions in GitLab (groups/projects) and working with AWS CodeCommit, AWS Secrets Manager, and AWS Landing Zone Accelerator (LZA).
• Solid understanding of AAA principles, RBAC/ABAC models, and identity lifecycle management.
• AWS Certified Security – Specialty, AWS Certified Solutions Architect – Associate, or Ping Identity / Keycloak certifications.
• The estimated salary range for this position is $90,000.00 - $150,000.00, commensurate on experience and technical skillset.
• We are strictly looking for direct, full-time W2 employees. We do not engage with third-party staffing agencies, C2C, or 1099 independent contractors for this role.
• We are proud to be an EEO/AA employer Minorities/Women/Veterans/Disabled and other protected categories.
• In compliance with federal law, all persons hired will be required to verify identity, confirm US Citizenship, and complete the required employment eligibility verification upon hire.

Qualifications & Requirements