Security Token Service Engineer (Identity & Access Management (IAM) Engineer)

Are you an experienced Identity Access Management Engineer who enjoys building secure authentication and authorization solutions rather than simply administering existing IAM platforms? Are you interested in developing foundational security services that enable enterprise-wide data connectivity, API integration, and emerging AI capabilities?

Let's chat and see if we are a good match!

Opportunity

Virtual Service Operations (VSO) is seeking an experienced Identity Access Management (IAM) Engineer to support a high-visibility enterprise platform modernization initiative.

This initiative is focused on developing reusable software platforms and services that enable secure data connectivity, interoperability, and AI integration across a large, complex enterprise environment.

The project involves building foundational tools and capabilities that allow enterprise applications, databases, and services to securely exchange information through standardized APIs and Model Context Protocol (MCP) servers.

This is not a traditional IAM administration, cloud migration, or infrastructure support role. We are looking for a hands-on engineer who can design, develop, integrate, and operate secure authentication and authorization services in a production environment.

You will play a key role in establishing the identity and security foundation for an enterprise integration platform, including identity federation, token management, credential security, certificate trust, and API authorization enforcement.

Key Responsibilities

Identity Authentication Services

• Design, develop, implement, and maintain authentication and authorization services supporting enterprise applications and APIs.
• Build and operate token services supporting token issuance, exchange, validation, revocation, and introspection.
• Implement secure authentication and authorization flows using OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0.
• Develop and maintain JSON Web Token (JWT) validation and token management capabilities.

Identity Federation Integration

• Integrate enterprise identity providers, including Microsoft Entra ID, Active Directory Federation Services (ADFS), and SiteMinder.
• Configure and integrate Keycloak as an identity broker, including realms, clients, identity providers, and protocol mappers.
• Establish secure federation and single sign-on capabilities across enterprise applications and services.
• Troubleshoot complex authentication, federation, and authorization issues.

API Security Authorization

• Implement authorization enforcement at API gateways using Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectural patterns.
• Develop and integrate secure access controls for APIs, applications, and backend services.
• Support standardized authentication and authorization approaches across distributed enterprise systems.
• Collaborate with platform and software engineering teams to integrate identity services into reusable enterprise capabilities.

Credential, Key Certificate Management

• Manage credential and cryptographic key lifecycles, including client secrets, signing keys, rotation, and secure storage.
• Implement and maintain Public Key Infrastructure (PKI) and certificate trust configurations.
• Support X.509 certificates, certificate authority (CA) chains, TLS/mTLS, certificate issuance, renewal, and revocation.
• Apply security best practices to protect service-to-service communications and sensitive credentials.

Security Engineering Documentation

• Document identity architectures, authentication flows, authorization models, and security integrations.
• Collaborate with cybersecurity, platform engineering, and development teams to ensure secure implementation.
• Support security assessments, technical reviews, audits, and authorization documentation.
• Contribute to scalable, reusable, and maintainable identity security solutions.

Required Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience.
• Minimum of 3 years of hands-on experience in Identity Access Management engineering, including designing, developing, or implementing authentication and authorization services in production environments.
• Demonstrated experience implementing OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 authentication and federation flows.
• Hands-on experience with token exchange, JWT validation, and token-based authentication.
• Experience integrating at least one enterprise identity provider, such as Microsoft Entra ID, ADFS, or SiteMinder.
• Experience with Keycloak or a comparable identity broker.
• Working knowledge of Public Key Infrastructure (PKI), X.509 certificates, and TLS/mTLS.
• Proficiency developing backend services using Java, Go, Python, or a comparable programming language.
• Strong troubleshooting, technical documentation, and problem-solving skills.
• Ability to collaborate effectively with software engineers, cloud architects, and cybersecurity professionals.

Preferred Qualifications

• Experience extending Keycloak using Service Provider Interfaces (SPIs), custom authenticators, or custom integrations.
• Experience implementing fine-grained authorization using Open Policy Agent (OPA) or comparable policy engines.
• Familiarity with Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectures.
• Experience with AWS Key Management Service (KMS), HashiCorp Vault, Hardware Security Modules (HSMs), or comparable key management technologies.
• Experience securing machine-to-machine communications, service accounts, and automated workloads.
• Familiarity with Model Context Protocol (MCP) and authorization approaches for AI-enabled applications or agents.
• Experience integrating identity and authorization services with API gateways.
• Familiarity with NIST 800-53, NIST 800-63, FedRAMP, or security authorization processes.
• Experience developing security services within AWS or other cloud environments.
• Experience supporting enterprise modernization, platform engineering, or distributed application integration initiatives.

• This is a remote role
• Bachelor’s degree
• Minimum of 3 years of hands-on experience in Identity Access Management engineering
• New hires assigned on this project will be required to undergo and pass drug and alcohol tests per our client's contract requirements
• Please note that this specific position requires U.S. citizenship status

What is Important to Us:

• You are an excellent communicator in writing and speaking.
• You have the ability to work independently but also value teamwork.
• Your problem-solving skills are excellent.
• You are looking for a job where performance appraisals occur regularly, and you look forward to advancing your career.
• You seek a community of virtue-centered co-workers and clients.

What we offer you: As part of the VSO company, you will be part of a virtue-centered team who value their work and teammates. This is a no-jerk zone. We provide ongoing learning and development opportunities to foster continuous growth. We offer competitive salaries, health benefits, and flexible work arrangements.

More About VSO: VSO is a hybrid cloud and managed services consulting firm. Much of VSO’s success can be attributed to our deep partnerships with IT services industry leaders such as AWS, IBM, Microsoft and others. VSO leverages numerous other partner relationships so as to provide our customers with optimal support. Additionally, we take pride in taking care of our employees. We offer a wide variety of benefits for eligible employees related to health, retirement, professional development, and more! For more information, please visit our website at https://vso-inc.com/careers