Security Token Service Engineer (Identity & Access Management (IAM) Engineer)
Virtual Service Operations, Inc.16 hours ago
Remote, United StatesMid Level
Base Salary
$210k - $250k/yr
Responsibilities
- Design, develop, implement, and maintain authentication and authorization services for enterprise applications and APIs.
- Build and operate token services supporting issuance, exchange, validation, revocation, and introspection.
- Implement OAuth 2.0, OpenID Connect, SAML 2.0, JWT, identity federation, and single sign-on capabilities.
- Integrate Microsoft Entra ID, ADFS, SiteMinder, and Keycloak identity services.
- Implement API authorization using PDP and PEP patterns and integrate identity services with API gateways.
- Manage client secrets, signing keys, cryptographic key lifecycles, PKI, X.509 certificates, certificate authorities, TLS/mTLS, issuance, renewal, and revocation.
- Document identity architectures, authentication flows, authorization models, and security integrations.
- Collaborate with platform engineering, software engineering, cloud architecture, and cybersecurity teams.
- Support security assessments, technical reviews, audits, and authorization documentation.
Requirements
- Bachelor’s degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience.
- At least 3 years of hands-on Identity and Access Management engineering experience designing, developing, or implementing production authentication and authorization services.
- Demonstrated experience with OAuth 2.0, OpenID Connect, SAML 2.0, token exchange, JWT validation, and token-based authentication.
- Experience integrating an enterprise identity provider such as Microsoft Entra ID, ADFS, or SiteMinder.
- Experience with Keycloak or a comparable identity broker.
- Working knowledge of PKI, X.509 certificates, and TLS/mTLS.
- Proficiency developing backend services with Java, Go, Python, or a comparable programming language.
- Strong troubleshooting, technical documentation, problem-solving, communication, and collaboration skills.
- Preferred experience extending Keycloak with SPIs, custom authenticators, or custom integrations.
- Preferred experience with OPA or comparable policy engines, PDP/PEP architectures, AWS KMS, HashiCorp Vault, HSMs, API gateways, MCP, cloud environments, and enterprise modernization initiatives.
- U.S. citizenship is required.
- New hires assigned to the project must pass drug and alcohol tests required by the client contract.
Benefits
- Remote work arrangement.
- Competitive salary, health benefits, retirement benefits, flexible work arrangements, and professional development opportunities.
- Ongoing learning and development opportunities within a virtue-centered team environment.
About Virtual Service Operations, Inc.
Virtual Service Operations (VSO) is a privately held IT services firm founded in 2017 and headquartered in Manassas, Virginia. It delivers managed IT and hybrid-cloud operations, cloud migration, end-user services, network consulting, and IT financial management, anchored by its FogLifter platform. VSO serves large commercial enterprises and U.S. federal and defense customers, including projects in classified DoD environments, providing cybersecurity support and TBM/IT financial management advisory.