Lead, Infrastructure Security Engineer - Customer Identity & Access Management

Description

The company's Global Technology Security Services team is building its next generation of customer identity and access management, using cloud identity platforms, adaptive authentication, fraud and risk detection, automation and modern authorization patterns.

This is a lead infrastructure security engineer role on the CIAM team, classified under Technology, Engineering and Cloud. Your engineering work will protect millions of customer interactions with secure, scalable and intelligent identity platforms.

Success is measured by your ability to deliver secure, reusable CIAM capabilities, reduce fraud exposure and customer friction, automate platform operations, speed up application onboarding, improve observability and incident resolution, raise engineering quality, and turn emerging customer identity risks into concrete technical controls.

Responsibilities

• Lead the design, development, testing, automation and support of security capabilities across the global CIAM ecosystem.
• Focus mainly on PingOne Advanced Identity Cloud, PingOne Protect, customer authentication journeys, CIAM APIs, mobile and web integrations, fraud and risk controls, and platform observability.
• Work with technical leads, product owners, application and mobile engineers, fraud and cyber teams, architects and delivery staff to build authentication, authorization, registration, account recovery, identity verification and step-up authentication solutions.
• Build and maintain advanced authentication, registration, account recovery, profile management, consent and step-up MFA journeys in PingOne Advanced Identity Cloud.
• Build and support custom journeys, custom nodes, JavaScript decision logic, validation rules, scripted policies, OIDC claims logic, API integrations and reusable CIAM components.
• Customize and support PingOne AIC hosted pages, covering branding, localization, frontend behavior, reusable themes, input validation, responsive layouts and accessibility compliance.
• Design and implement PingOne Protect within customer identity flows, including global and application risk policies, standard and custom predictors, composite risk decisions, group mappings, device and behavioral signals, registration velocity, compromised credential indicators and external fraud intelligence.
• Build proactive fraud mitigation that can allow, challenge, step up, throttle, block or route a transaction for extra verification based on the risk evaluated.
• Work with teams across the business, including cyber fraud and business partners.

Requirements

• Bachelor's degree in computer science, software engineering, cybersecurity, information systems or a related field, or equivalent professional experience showing senior-level architecture and engineering depth.
• Typically 5.5 or more years of progressive experience in IAM, security, software, platform or cloud engineering, delivering CIAM solutions, leading complex technical designs or global application integrations.
• Proven ownership of customer-facing identity solutions for high-volume web, native mobile, SPA, BFF, API, microservice, partner, call-center and machine-to-machine channels across regions, environments and business units.
• Advanced hands-on skill with PingOne AIC SaaS: journey design, nested journeys, custom and scripted decision nodes, authentication levels, session configuration, hosted pages, identity schemas, managed objects, AM and IDM APIs, application policies, OIDC claims scripts, environment promotion and production troubleshooting.
• Hands-on PingOne Protect integration for fraud detection, adaptive authentication, device intelligence, behavioral analytics, bot detection, identity verification and external risk signals. Able to create predictors and composite policies, tune thresholds, interpret risk evidence, control false positives and implement allow, challenge, step-up, throttle, block or manual-review outcomes.
• Integrate and troubleshoot Ping journey and device-profiling SDKs in JavaScript, React Native, Android, iOS and Flutter, covering callback rendering, browser and deep-link redirects, PKCE verifier persistence, cookie behavior, device identifiers, CORS/CSP, network failures, app lifecycle transitions, token renewal and diagnostic logging.
• Design and implement coarse- and fine-grained authorization: least-privilege scopes, granular business roles, entitlements, resource/action models, consent, relationship and contextual attributes, JWT access-token claims, policy decision and enforcement points, obligations, deny-by-default behavior and domain-service ownership boundaries.
• Strong production coding in at least two of Java, JavaScript/TypeScript, Python, Spring, Node.js, React, PowerShell or shell, with evidence of maintainable modules, tests, API clients, migration utilities, validation tools, pipeline automation, operational scripts and reusable platform accelerators.
• Advanced REST API engineering: resource and contract design, HTTP semantics, JSON schemas, pagination, filtering, idempotency, retries, rate limits, webhooks and callbacks, authentication headers, error models, correlation IDs, backward compatibility, mocks, Postman collections, negative testing and automated contract validation against PingOne AIC and downstream services.
• Strong Splunk and Dynatrace skills: SPL, field extraction, nested JSON parsing, dashboards, service-level indicators, transaction correlation, alert design, baseline and threshold tuning, distributed tracing, latency segmentation, root-cause analysis, and privacy-aware handling of tokens, credentials, device data and customer PII.
• Experience running high-volume identity and application migrations with batching, checkpointing, restartability, reconciliation, credential migration, schema mapping, exception queues, audit trails, rollback controls, cutover orchestration, coexistence, performance testing and post-migration verification.
• Proven CIAM architecture leadership: run discovery and whiteboarding sessions with application, product, domain-service, fraud, cyber, privacy, cloud, network, operations and vendor teams. Find missing requirements, tell existing patterns from new ones, challenge unsafe assumptions and drive decisions to closure.
• Understand customer and business-service processes, including registration, authentication, servicing, profile management, account recovery, consent, identity proofing, fraud review, partner access, entitlement and downstream data access, and turn them into actors, trust boundaries, service ownership, auth flows, API contracts, claims, controls, exceptions and measurable outcomes.
• Deliver under aggressive timelines: find the minimum safe scope quickly, reuse approved patterns, size complexity, sequence dependencies, time-box decisions, expose critical-path risk, name accountable owners, write sprint-ready acceptance criteria, secure architecture approvals, and carry work through testing, operational readiness, release and stabilization.
• Work independently in ambiguity: build proof-of-concept code and measurable evidence, compare architecture options, document assumptions and trade-offs, make a clear recommendation, escalate unresolved risk and stay involved through implementation and production validation.
• Excellent written, verbal and executive communication: lead code and design reviews, challenge senior stakeholders constructively, explain identity and fraud risk in business terms, define ownership boundaries, and communicate decisions, residual risk, delivery status and required actions clearly.
• Preferred: be ready to discuss and demonstrate a production implementation you personally designed and delivered, such as a PingOne AIC journey or OAuth client, a full Ping Identity Gateway route with conditions and chain filters, an AWS EKS deployment through CI/CD, Route 53 and ALB traffic flow, granular scopes or roles with JWT claims, automated negative tests, observability, failure diagnosis, and the architecture decisions that balanced security, customer experience, reuse and delivery urgency.

Conditions

The base salary range for this role is $133,600 to $220,400. Pay within that range may vary based on factors such as geographic location, candidate experience and skills.

The salary range is included because state laws require it for hires in applicable locations.

Prudential may use identity verification technology during hiring, and your consent will be requested before any verification takes place.

The company is not affiliated with Prudential plc, a company headquartered in the United Kingdom.

Benefits

• Market-competitive base salary, with yearly bonus potential at every level.
• Eligibility for a discretionary annual incentive program, where any award depends on individual and organizational performance and the program's rules.
• Medical, dental, vision, life and disability insurance, paid time off, and leave such as parental and military leave.
• 401(k) plan with a company match of up to 4%.
• Company-funded pension plan.
• Wellness reimbursement of up to $1,600 a year for items that support personal wellbeing.
• Work and life resources covering parenting, housing, senior care, finances, pets, legal matters, education, emotional and mental health, and career development.
• Education benefit to help finance traditional college enrollment toward an approved degree and many accredited certificate programs.
• Employee stock purchase plan: shares can be bought at 85% of the lower of the price at the start or end of the purchase period.
• Some benefits may not apply to part-time employees scheduled to work fewer than 20 hours a week.