Security Token Service Engineer (Identity & Access Management (IAM) Engineer)

Job TypeFull-timeDescriptionAre you an experienced Identity & Access Management Engineer who enjoys building secure authentication and authorization solutions rather than simply administering existing IAM platforms? Are you interested in developing foundational security services that enable enterprise-wide data connectivity, API integration, and emerging AI capabilities? Let's chat and see if we are a good match!OpportunityVirtual Service Operations (VSO) is seeking an experienced Identity & Access Management (IAM) Engineer to support a high-visibility enterprise platform modernization initiative.This initiative is focused on developing reusable software platforms and services that enable secure data connectivity, interoperability, and AI integration across a large, complex enterprise environment.The project involves building foundational tools and capabilities that allow enterprise applications, databases, and services to securely exchange information through standardized APIs and Model Context Protocol (MCP) servers.This is not a traditional IAM administration, cloud migration, or infrastructure support role. We are looking for a hands-on engineer who can design, develop, integrate, and operate secure authentication and authorization services in a production <environment.You> will play a key role in establishing the identity and security foundation for an enterprise integration platform, including identity federation, token management, credential security, certificate trust, and API authorization enforcement. Key ResponsibilitiesIdentity & Authentication ServicesDesign, develop, implement, and maintain authentication and authorization services supporting enterprise applications and <APIs.Build> and operate token services supporting token issuance, exchange, validation, revocation, and introspection.Implement secure authentication and authorization flows using OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0.Develop and maintain JSON Web Token (JWT) validation and token management capabilities.Identity Federation & IntegrationIntegrate enterprise identity providers, including Microsoft Entra ID, Active Directory Federation Services (ADFS), and SiteMinder.Configure and integrate Keycloak as an identity broker, including realms, clients, identity providers, and protocol mappers.Establish secure federation and single sign-on capabilities across enterprise applications and services.Troubleshoot complex authentication, federation, and authorization issues.API Security & AuthorizationImplement authorization enforcement at API gateways using Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectural patterns.Develop and integrate secure access controls for APIs, applications, and backend <services.Support> standardized authentication and authorization approaches across distributed enterprise systems.Collaborate with platform and software engineering teams to integrate identity services into reusable enterprise capabilities.Credential, Key & Certificate ManagementManage credential and cryptographic key lifecycles, including client secrets, signing keys, rotation, and secure storage.Implement and maintain Public Key Infrastructure (PKI) and certificate trust <configurations.Support> X.509 certificates, certificate authority (CA) chains, TLS/mTLS, certificate issuance, renewal, and revocation.Apply security best practices to protect service-to-service communications and sensitive <credentials.Security> Engineering & DocumentationDocument identity architectures, authentication flows, authorization models, and security integrations.Collaborate with cybersecurity, platform engineering, and development teams to ensure secure <implementation.Support> security assessments, technical reviews, audits, and authorization documentation.Contribute to scalable, reusable, and maintainable identity security solutions. Required QualificationsBachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience.Minimum of 3 years of hands-on experience in Identity & Access Management engineering, including designing, developing, or implementing authentication and authorization services in production environments.Demonstrated experience implementing OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 authentication and federation flows.Hands-on experience with token exchange, JWT validation, and token-based authentication.Experience integrating at least one enterprise identity provider, such as Microsoft Entra ID, ADFS, or SiteMinder.Experience with Keycloak or a comparable identity broker.Working knowledge of Public Key Infrastructure (PKI), X.509 certificates, and TLS/mTLS.Proficiency developing backend services using Java, Go, Python, or a comparable programming language.Strong troubleshooting, technical documentation, and problem-solving skills.Ability to collaborate effectively with software engineers, cloud architects, and cybersecurity professionals.Preferred QualificationsExperience extending Keycloak using Service Provider Interfaces (SPIs), custom authenticators, or custom integrations.Experience implementing fine-grained authorization using Open Policy Agent (OPA) or comparable policy engines.Familiarity with Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectures.Experience with AWS Key Management Service (KMS), HashiCorp Vault, Hardware Security Modules (HSMs), or comparable key management technologies.Experience securing machine-to-machine communications, service accounts, and automated workloads.Familiarity with Model Context Protocol (MCP) and authorization approaches for AI-enabled applications or agents.Experience integrating identity and authorization services with API gateways.Familiarity with NIST 800-53, NIST 800-63, FedRAMP, or security authorization processes.Experience developing security services within AWS or other cloud environments.Experience supporting enterprise modernization, platform engineering, or distributed application integration initiatives.RequirementsThis is a remote roleBachelor’s degree Minimum of 3 years of hands-on experience in Identity & Access Management engineeringNew hires assigned on this project will be required to undergo and pass drug and alcohol tests per our client's contract requirementsPlease note that this specific position requires U.S. citizenship statusWhat is Important to Us:You are an excellent communicator in writing and <speaking.You> have the ability to work independently but also value teamwork.Your problem-solving skills are <excellent.You> are looking for a job where performance appraisals occur regularly, and you look forward to advancing your <career.You> seek a community of virtue-centered co-workers and clients.What we offer you: As part of the VSO company, you will be part of a virtue-centered team who value their work and teammates. This is a no-jerk zone. We provide ongoing learning and development opportunities to foster continuous growth. We offer competitive salaries, health benefits, and flexible work arrangements.More About VSO: VSO is a hybrid cloud and managed services consulting firm. Much of VSO’s success can be attributed to our deep partnerships with IT services industry leaders such as AWS, IBM, Microsoft and others. VSO leverages numerous other partner relationships so as to provide our customers with optimal support. Additionally, we take pride in taking care of our employees. We offer a wide variety of benefits for eligible employees related to health, retirement, professional development, and more! For more information, please visit our website at <https://vso-inc.com/careers> Salary Description$210,000 - $250,000