CIAM Engineer

About the role

A CIAM Engineer designs, builds and operates secure, reliable customer identity and access management services. You will help customers register, sign in, recover their accounts and manage their security settings across web and mobile applications, working with product, application engineering, security, privacy and platform teams to balance security, usability and operational reliability.

Key responsibilities

• Design and implement customer identity journeys: registration, identity verification, sign-in, multi-factor authentication (MFA), account recovery and account deletion.
• Integrate web and mobile applications with the CIAM platform using OpenID Connect (OIDC), OAuth 2.0 and SAML 2.0 where required.
• Configure and maintain authentication policies, federation connections, identity flows and session and token settings.
• Implement controls against account takeover, credential stuffing and automated abuse, and strengthen authentication where risk warrants it.
• Build automated tests and deployment pipelines for identity services and platform configuration, supporting safe rollouts and rollbacks.
• Monitor authentication availability, latency and success rates, investigate production incidents and address recurring failure modes.
• Partner with security and privacy teams on data controls such as data minimization, retention and deletion.
• Maintain technical documentation, integration guides and operational runbooks.

Required profile

• Hands-on experience implementing and operating customer-facing identity or authentication services in production.
• Practical experience with at least one CIAM platform such as Auth0, Ping Identity, Microsoft Entra External ID or AWS Cognito.
• Ability to explain security and user experience trade-offs clearly and work with technical and non-technical stakeholders.

Required skills

• Strong understanding of OAuth 2.0 and OpenID Connect, including Authorization Code with PKCE, token validation and session management.
• Experience implementing MFA, account recovery and federation; troubleshooting authentication failures across applications, APIs and identity providers.
• Proficiency in at least one backend or platform language such as Java, C#, TypeScript, Python or Go.
• Experience with automated testing, CI/CD and production troubleshooting using logs and metrics.
• Preferred: passkeys with WebAuthn and FIDO2, risk-based authentication, bot mitigation, identity migration, Terraform and GDPR.