> Markdown version of [/jobs/ext/4024928-security-token-service-engineer-identity-access-management-iam-engineer](https://www.wearedevelopers.com/jobs/ext/4024928-security-token-service-engineer-identity-access-management-iam-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Security Token Service Engineer (Identity & Access Management (IAM) Engineer) - **Company:** Virtual, Inc. - **Location:** United States (Remote available) - **Experience:** Experienced - **Salary:** $210,000.0 - $250,000.0 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Active Directory Federation Services, Application Programming Interfaces (APIs), Artificial Intelligence, Amazon Web Services, Application Integration Architecture, Computing Platforms, Architectural Patterns, User Authentication, Cyber Security, Databases, Data Security, Federated Identity Management, Hardware Security Module, Identity and Access Management, Interoperability, Python (Programming Language), Key Management, OAuth, OpenID, Public Key Infrastructure, X.509, Openid Connect, Azure Active Directory, JSON Web Token, Security Assertion Markup Language (SAML), Single Sign-On, Software Engineering, Systems Integration, SSL Certificate Management, Enterprise Software Applications, Cloud Platform System, Okta, Software Security, Software Troubleshooting, Backend, Siteminder, Information Technology, Hashicorp, Enterprise Integration, Api Gateway, Model Context Protocol, Golang, Programming Languages - **Published:** October 30, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=d6fff696f8fba790 ## About the Role * Bachelor's degree in Computer Science, Cybersecurity, Software Engineering, or a related technical field, or equivalent professional experience. * Minimum of 3 years of hands-on experience in Identity & Access Management engineering, including designing, developing, or implementing authentication and authorization services in production environments. * Demonstrated experience implementing OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0 authentication and federation flows. * Hands-on experience with token exchange, JWT validation, and token-based authentication. * Experience integrating at least one enterprise identity provider, such as Microsoft Entra ID, ADFS, or SiteMinder. * Experience with Keycloak or a comparable identity broker. * Working knowledge of Public Key Infrastructure (PKI), X.509 certificates, and TLS/mTLS. * Proficiency developing backend services using Java, Go, Python, or a comparable programming language. * Strong troubleshooting, technical documentation, and problem-solving skills. * Ability to collaborate effectively with software engineers, cloud architects, and cybersecurity professionals., * Experience extending Keycloak using Service Provider Interfaces (SPIs), custom authenticators, or custom integrations. * Experience implementing fine-grained authorization using Open Policy Agent (OPA) or comparable policy engines. * Familiarity with Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectures. * Experience with AWS Key Management Service (KMS), HashiCorp Vault, Hardware Security Modules (HSMs), or comparable key management technologies. * Experience securing machine-to-machine communications, service accounts, and automated workloads. * Familiarity with Model Context Protocol (MCP) and authorization approaches for AI-enabled applications or agents. * Experience integrating identity and authorization services with API gateways. * Familiarity with NIST 800-53, NIST 800-63, FedRAMP, or security authorization processes. * Experience developing security services within AWS or other cloud environments. * Experience supporting enterprise modernization, platform engineering, or distributed application integration initiatives. Requirements: * This is a remote role * Bachelor's degree * Minimum of 3 years of hands-on experience in Identity & Access Management engineering * New hires assigned on this project will be required to undergo and pass drug and alcohol tests per our client's contract requirements * Please note that this specific position requires U.S. citizenship status What is Important to Us: * You are an excellent communicator in writing and speaking. * You have the ability to work independently but also value teamwork. * Your problem-solving skills are excellent. * You are looking for a job where performance appraisals occur regularly, and you look forward to advancing your career. * You seek a community of virtue-centered co-workers and clients. ## Description Virtual Service Operations (VSO) is seeking an experienced Identity & Access Management (IAM) Engineer to support a high-visibility enterprise platform modernization initiative. This initiative is focused on developing reusable software platforms and services that enable secure data connectivity, interoperability, and AI integration across a large, complex enterprise environment. The project involves building foundational tools and capabilities that allow enterprise applications, databases, and services to securely exchange information through standardized APIs and Model Context Protocol (MCP) servers. This is not a traditional IAM administration, cloud migration, or infrastructure support role. We are looking for a hands-on engineer who can design, develop, integrate, and operate secure authentication and authorization services in a production environment. You will play a key role in establishing the identity and security foundation for an enterprise integration platform, including identity federation, token management, credential security, certificate trust, and API authorization enforcement., Identity & Authentication Services * Design, develop, implement, and maintain authentication and authorization services supporting enterprise applications and APIs. * Build and operate token services supporting token issuance, exchange, validation, revocation, and introspection. * Implement secure authentication and authorization flows using OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0. * Develop and maintain JSON Web Token (JWT) validation and token management capabilities. Identity Federation & Integration * Integrate enterprise identity providers, including Microsoft Entra ID, Active Directory Federation Services (ADFS), and SiteMinder. * Configure and integrate Keycloak as an identity broker, including realms, clients, identity providers, and protocol mappers. * Establish secure federation and single sign-on capabilities across enterprise applications and services. * Troubleshoot complex authentication, federation, and authorization issues. API Security & Authorization * Implement authorization enforcement at API gateways using Policy Decision Point (PDP) and Policy Enforcement Point (PEP) architectural patterns. * Develop and integrate secure access controls for APIs, applications, and backend services. * Support standardized authentication and authorization approaches across distributed enterprise systems. * Collaborate with platform and software engineering teams to integrate identity services into reusable enterprise capabilities. Credential, Key & Certificate Management * Manage credential and cryptographic key lifecycles, including client secrets, signing keys, rotation, and secure storage. * Implement and maintain Public Key Infrastructure (PKI) and certificate trust configurations. * Support X.509 certificates, certificate authority (CA) chains, TLS/mTLS, certificate issuance, renewal, and revocation. * Apply security best practices to protect service-to-service communications and sensitive credentials. Security Engineering & Documentation * Document identity architectures, authentication flows, authorization models, and security integrations. * Collaborate with cybersecurity, platform engineering, and development teams to ensure secure implementation. * Support security assessments, technical reviews, audits, and authorization documentation. * Contribute to scalable, reusable, and maintainable identity security solutions.