Senior IAM / SSO Engineer

The service responsible for Identity and Access Management (IAM) for our client manages several hundred thousand accounts (employees, partners, users) and their access to the organisation's numerous digital services.

To strengthen its authentication and access authorisation activities, the team is looking for a senior engineer experienced in the field of identities and access management (IAM), particularly with all SSO authentication technologies and protocols and identity federation, within a complex large enterprise environment of several thousand people.

Education

• University Master’s degree in computer science, EPF / HES engineering diploma, federal diploma or equivalent training.

Essential skills

• Excellent command of identity federation protocols SAML, OAuth2 and OpenID Connect, and main IAM protocols (LDAP, Kerberos, Radius, SCIM, FIDO2/WebAuthn, OATH).

• Good command of Java language in a web server environment (able to understand and correct code if necessary).

• Good understanding of web security frameworks and API security, especially in Single-Page Application (SPA) environments.

• Good command of IAM concepts (authentication and access management in RBAC model, directories and digital identities, ABAC and ReBAC notions).

Important skills

• Good command of on-premise enterprise directories (LDAP and Microsoft AD) and Cloud environments (MS Entra ID).

• Good knowledge of Unix/Linux and Windows server environments.

• Proven experience managing critical production infrastructures.

• Good understanding of Zero Trust access control strategies and their application in web architectures, notably at the level of web reverse proxies (F5 Big-IP or Apache), applications and APIs.

• Good command of CI/CD approach and containerised environments.

• Good awareness of software quality, secure code development and implementation of unit, integration and performance testing.

Additional skills

• Successful experience in one or more of the following areas:

  • Administration of a market SSO server (OpenAM, KeyCloak, Okta, PingOne).

  • Implementation of a project in a Platform-as-a-Service environment (preferably OpenShift or Docker) or Azure Active Directory.

  • Administration of an LDAP directory (Novell e-Directory, OpenLDAP, OpenDS).

  • Implementation of an IAM project using one of the following protocols: Radius, OATH, MS-OFBA, SCIM.

  • Experience with main encryption/signature algorithms (PKI, certificate stores).

  • Experience with IAM Cloud environments (MS Entra ID, Okta).

  • Good knowledge of web application servers (especially JBoss, Tomcat, Apache PHP).

  • Mastery of Archimate modelling language and an associated tool (Archi, iServer).

  • Successful experience in a large private or public enterprise environment.

Objectives and missions

• Contribute to maintaining and continuously evolving the portfolio of digital authentication and authorisation services, integrated into the overall IAM (Identity and Access Management) support offering.

• Provide technical expertise on the components.

• Handle requests and provide support to client IT teams of these offerings and their users.

Main activities

• Support the service manager and IAM architects in the operation of the support service.

• Act as technical expert on service components (market tools and specific developments).

• Handle incidents/problems and provide level 3 technical support for teams responsible for infrastructure integration and operation.

• Participate in the implementation and maintenance of diagnostic tools and monitoring indicators.

• Identify risks related to technical or security aspects and propose necessary corrections and improvements.

• Participate in service offering evolution projects (design, development/implementation, test campaigns, technical operations, configuration, migration, deployment monitoring).

• Participate in the definition, implementation and evolution of IAM integration flows (SAML, OAuth2, OpenID Connect, etc.) for business applications.

• Handle IAM integration requests (configuration specific to each flow).

• Advise and support, as an IAM expert, architects and developers in implementing integration flows.

• Participate in projects and technical studies related to service components.

• Participate in continuous improvement of service components and be proactive in improving team organisation.

• Occasionally support application architects to determine the appropriate IAM integration solution for their needs (SAML, OAuth2/OIDC, LDAP, etc.).

Required qualities

• Sense of service, responsibility and communication.

• Ability to develop skills across an entire technical domain.

• Fluency in French, good command of English.

• Excellent oral and written expression.

• Ability to show initiative, flexibility and stress resistance.

• Ability to work in a team and share knowledge.