CIAM Engineer

Role Overview

We are looking for a CIAM Engineer to design, build, and operate secure, reliable customer identity and access management services. You will help customers register, sign in, recover their accounts, and manage their security settings across web and mobile applications.

You will work with product, application engineering, security, privacy, and platform teams to balance security, usability, and operational reliability throughout the customer identity lifecycle.

Key Responsibilities

• Design and implement customer identity journeys, including registration, identity verification, sign-in, multi-factor authentication (MFA), account recovery, and account deletion.
• Integrate web and mobile applications with the CIAM platform using OpenID Connect (OIDC), OAuth 2.0, and SAML 2.0 where required.
• Configure and maintain authentication policies, federation connections, identity flows, and session and token settings.
• Implement controls against account takeover, credential stuffing, and automated abuse. Work with product and security teams to introduce stronger authentication where risk warrants it.
• Build automated tests and deployment pipelines for identity services and platform configuration. Support safe rollouts and rollbacks for changes that affect customer access.
• Monitor authentication availability, latency, and success rates. Investigate production incidents and address recurring failure modes.
• Partner with security and privacy teams to implement customer identity data controls, including data minimization, retention, and deletion.
• Maintain technical documentation, integration guides, and operational runbooks for teams that depend on the CIAM platform.

Required Qualifications

• Hands-on experience implementing and operating customer-facing identity or authentication services in production.
• Practical experience with at least one CIAM platform, such as Auth0, Ping Identity, Microsoft Entra External ID, or AWS Cognito.
• Strong understanding of OAuth 2.0 and OpenID Connect, including Authorization Code with PKCE, token validation, and session management.
• Experience implementing MFA, account recovery, and federation. Ability to troubleshoot authentication failures across applications, APIs, and identity providers.
• Proficiency in at least one programming language used for backend or platform engineering, such as Java, C#, TypeScript, Python, or Go.
• Experience with automated testing, CI/CD, and production troubleshooting using logs and metrics.
• Ability to explain security and user experience trade-offs clearly and work with both technical and non-technical stakeholders.

Preferred Qualifications

• Experience implementing passkeys or other passwordless authentication using WebAuthn and FIDO2.
• Experience with risk-based authentication, bot mitigation, or account takeover detection.
• Experience migrating customer identities between platforms, including planning for credential continuity and staged cutovers.
• Experience managing identity platform configuration with infrastructure-as-code tools such as Terraform.
• Familiarity with privacy requirements for customer identity data, such as GDPR, and experience translating them into technical controls.