Principal Authentication Services Engineer

What you'll do

• Own the engineering design, implementation, and operational health of Microsoft Entra ID, Active Directory, and federated identity services.
• Architect and maintain SSO integrations using SAML, OIDC, and OAuth 2.0 across SaaS, on-prem, and hybrid portfolios.
• Engineer and manage MFA policies, authentication methods, and phishing-resistant credentials like FIDO2 and Windows Hello.
• Lead Conditional Access policy development, testing, and lifecycle governance.
• Define authentication standards, patterns, and reference architectures for new and existing applications.
• Evaluate emerging authentication technologies and drive proof-of-concept efforts to inform the roadmap.
• Maintain technical documentation including architecture diagrams, decision records, and runbooks.
• Support audit and compliance activities by providing technical evidence, control narratives, and remediation guidance.

What we're looking for

• Bachelor’s degree or higher completed and verified prior to start.
• Eight years of experience designing, deploying, and managing enterprise Identity and Access Management (IAM) authentication solutions.
• Five years of experience working with modern authentication protocols including SAML, OAuth 2.0, OpenID Connect, and FIDO2.
• Five years of experience leading complex architectural initiatives, conditional access hardening, or Zero Trust security programs.
• Must be legally authorized to work in the country of employment.
• Ability to work in a hybrid capacity in Maplewood, MN or Austin, TX at least 3 days per week.