SSO Software Engineer (Senior Identity & Access Management Engineer)
This is a Full-Time (100% On-Site) Position in Philadelphia, PA 19107 supporting SEPTA (Southeastern Pennsylvania Transportation Authority). Full employee benefits, PTO, and paid holidays are inclusive to this position.
Number of Available Positions: 1
Contract Term: 2 Years
Salary Target: $105K-$125K/YR(W2) (Salary is flexible based on relevant professional experience and background related to the position)
Job Description:
We are seeking a senior engineer with hands-on Identity and Access Management experience to deliver federated single sign-on (SSO) for an existing institutional web application. Partner institutions will act as the Identity Provider (IdP); our platform will act as the Service Provider (SP) via Amazon Cognito.
The successful candidate will take ownership of an application originally built by an outgoing consultancy, design the federation architecture, implement it end to end across React, TypeScript/Express and AWS infrastructure, onboard a pilot institution, and hand over a fully documented, supportable system to internal staff at the end of the engagement.
Responsibilities:
1. Design the federation architecture and record the decisions (tenancy model, home-realm discovery, protocol support, just-in-time provisioning policy, claim-to-role mapping) as reviewable Architecture Decision Records (ADR).
- Implement SAML 2.0 and OIDC identity provider integration in Amazon Cognito, defined entirely in infrastructure as code.
- Make the Express backend an OAuth 2.0 confidential client: initiate the authorization request, exchange the code server-side, validate the ID token, and mint the existing sealed session so that no tokens reach the browser.
- Rework the sign-in experience across both portals to support home-realm discovery, error handling and sign-out, meeting WCAG 2.1 AA.
- Extend the Express authentication and authorization middleware and the shared authorization module: federated session establishment, role and institution resolution, roster binding, and enforcement of institution isolation across every route.
- Implement account linking so an existing OTP user and their federated identity resolve to a single account.
- Build administrative tooling for internal IT to configure, test and monitor an institution's SSO connection, including certificate and metadata expiry alerting.
- Establish a test IdP harness and automated end-to-end coverage for the authentication paths, including negative and abuse cases.
- Support security review and penetration testing; remediate findings.
10. Lead the technical relationship with pilot institution IdP administrators through metadata exchange, attribute agreement and testing.
Produce runbooks, an institution onboarding pack and an operations handbook, and deliver knowledge transfer sessions to internal staff.
Skills & Experience:
1. Demonstrable delivery of enterprise SSO integrations where the customer or partner organization was the IdP, across multiple tenants — not a single internal SSO rollout.
2. Practical knowledge of SAML 2.0 (metadata, NameID formats, assertion consumer service, signing and encryption, relay state, SP-initiated and IdP-initiated flows) and OpenID Connect / OAuth 2.0 (authorization code flow with PKCE, JWT validation, token lifetimes, refresh and revocation).
3. Production experience with Amazon Cognito user pools: external identity providers, attribute mapping, Lambda triggers, hosted UI / managed login, custom domains, account linking, and the service's quotas and constraints.
- Strong TypeScript/Node.js (Express) and React. Familiarity with server-side session patterns rather than token-in-browser designs.
- AWS: ECS, DynamoDB, Lambda, SQS, S3, Cognito.
6. CloudFormation specifically, including change sets, resource import, deletion and replace policies, and recovering a stack from a failed update. This project touches a stack that also runs the live service, so change-set discipline is paramount.
- CI/CD pipeline work (CodePipeline / CodeBuild).
8. Multi-tenant security design: tenant isolation, least privilege, claim-based authorization, threat modelling.
- Ability to work directly and credibly with third-party IdP administrators, translating between their environment and ours.
- Clear technical writing — architecture documentation, ADRs and operational runbooks are contractual deliverables, not afterthoughts.
