Gestão de Identidade e Acesso (IAM) - Sênior

Your tasks

• Build, configure, test, and validate the PingOne Advanced Identity Cloud environment, ensuring successful integration with enterprise applications, corporate platforms, and third-party partner systems.
• Ensure the stability, availability, and continuous operation of identity integrations following production deployment, providing advanced support and implementing ongoing improvements.
• Implement, configure, and troubleshoot adaptive onboarding and authentication journeys, passwordless login, multi-factor authentication (MFA), single sign-on (SSO), secure account recovery, and delegated organization administration.
• Develop and maintain identity integrations using REST APIs, OpenID Connect (OIDC), OAuth 2.0, SAML 2.0, and SCIM 2.0.
• Implement advanced security protocols and mechanisms, including FAPI 2.0, Pushed Authorization Requests (PAR), Rich Authorization Requests (RAR), PKCE, mutual TLS (mTLS), JWK-based Proof of Possession, and Dynamic Client Registration (DCR).
• Design and maintain integrations involving partner ecosystems and emerging AI agent or Model Context Protocol (MCP) use cases, applying appropriate identity and security standards.
• Investigate and resolve complex integration issues across identity platforms, applications, API gateways, and downstream systems, performing end-to-end troubleshooting to identify root causes.
• Develop and maintain customized integrations and authentication workflows when native platform capabilities are insufficient to meet specific business or technical requirements.
• Collaborate closely with security, IAM, application, and infrastructure teams to gather requirements, validate technical approaches, implement solutions, and support production operations.
• Support solution architects in designing complex integrations through hands-on technical validation, prototyping, and proof-of-concept development.
• Produce and maintain technical documentation, including as-built architecture documentation, integration specifications, configuration details, and operational runbooks.
• Facilitate the transition from implementation to production support by establishing operational procedures, troubleshooting guidelines, and knowledge-transfer documentation.

Requirements

• Professional experience: At least five years of hands-on experience implementing and supporting large-scale enterprise Identity and Access Management (IAM) or Customer Identity and Access Management (CIAM) solutions.
• IAM platforms: Practical experience with one or more enterprise identity platforms, such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra ID, Keycloak, CyberArk, or equivalent solutions.
• CIAM and authentication: At least three years of solid knowledge and experience with CIAM concepts, adaptive authentication, granular authorization models such as RBAC and ABAC, SSO, MFA, and passwordless authentication technologies, including WebAuthn, FIDO2, and passkeys.
• Identity orchestration: At least three years of experience developing and maintaining authentication journeys, authentication trees, and identity orchestration workflows, including integrations with web and mobile applications through APIs and SDKs.
• API integration and scripting: At least three years of practical experience working with REST APIs, developing scripts using languages such as JavaScript, Groovy, or Python, manipulating payloads and tokens, and integrating identity services with backend systems.
• Identity and security protocols: Strong practical knowledge of OAuth 2.0, OpenID Connect (OIDC), and SAML 2.0, including their application in enterprise authentication and authorization scenarios.
• Token and cryptographic standards: Familiarity with JWT, JWS, and JWKS, as well as secure token handling and identity integration patterns.
• Troubleshooting and diagnostics: Ability to investigate complex, end-to-end technical issues across applications, API gateways, identity platforms, and downstream services.
• Preferred experience with Ping AIC: Hands-on experience implementing, configuring, and supporting PingOne Advanced Identity Cloud is a strong advantage.
• Advanced security standards: Practical experience with financial-grade API security profiles and advanced OAuth standards, including FAPI 2.0, PAR, RAR, mTLS, JWK-based Proof of Possession, and Dynamic Client Registration (DCR, RFC 7591), is desirable.
• Technical problem-solving: Strong analytical skills, attention to detail, and the ability to troubleshoot complex identity integrations and develop solutions beyond standard platform functionality.
• Collaboration and communication: Ability to work effectively with architects and cross-functional teams, translate requirements into technical implementations, and document solutions clearly.

What we offer

• Work arrangement: Remote work opportunity based in Brazil.
• Employment type: Full-time position.
• Professional development: Opportunity to work with enterprise-grade IAM and CIAM technologies, modern identity architectures, and advanced authentication standards.
• Technical growth: Exposure to PingOne Advanced Identity Cloud, complex identity integrations, and emerging security use cases involving AI agents and MCP.
• Collaborative environment: Opportunity to work alongside security specialists, architects, application teams, and infrastructure professionals on challenging technology initiatives.

How to apply

How Jobgether works We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Other

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.