CIAM Engineer

Customer Identity and Access Management Specialist. This role is the subject matter expert for customer identity and fine-grained authorization on a new customer portal that brings CRM data, online banking, and a mobile app to customers. Large customer entities have many individuals who need different access across lending, bookkeeping, tax preparation, and estate planning, along with delegated access for outside CPAs and advisors. The specialist plans and orchestrates that authorization model with the business and a global consulting firm, and ensures customer access decisions stay least-privileged, privacy-aware, testable, and auditable. Compensation: $60 to $85 per hour, W-2, flex depending on experience Logistics: Contract to hire. Hybrid for candidates within roughly 3 hours' drive of Connecticut, with onsite visits for key meetings and rollouts(lodging covered) Here's what you'll be doing: Plan and orchestrate fine-grained authorization with the business, key stakeholders, and the implementation partner Design and review FGA models, including resource types, relationships, inheritance, roles, attributes, permissions, policy rules, and relationship tuples Apply ReBAC, RBAC, and ABAC patterns to enforce customer data segregation, least privilege, consent restrictions, and deny-by-default behavior Model multi-individual business customers, delegated access for external CPAs and financial planners, and different access by service line Lead requirements for customer signup, login, MFA, account recovery, account linking, identity proofing touchpoints, profile management, session and token handling, and high-risk transactions Define customer identity sources, identifiers, correlation, account linking, relationship attributes, and lifecycle states ahead of authorization design Translate customer journeys, personas, channels, and acceptance criteria into CIAM requirements and a managed delivery backlog Partner with digital portal, Salesforce, banking platform, integration, data, customer support, privacy, fraud, and application teams to embed secure customer access Contribute to the CIAM and FGA platform evaluation (Ping and Okta are the leading candidates) Define how FGA stores and check APIs integrate with the CIAM platform, token issuance, application sessions, data sources, and consuming applications Establish policy ownership, approval, model promotion, versioning, exception, and change governance Review tuple generation, caching, latency, availability, failure handling, and fallback behavior so service degradation never opens unauthorized access Oversee build and configuration of CIAM and FGA environments, and coordinate migration, reconciliation, and validation of customer identities, relationships, and authorization data Develop and execute SIT, UAT, negative, regression, security, performance, resilience, and failure-mode tests traced to requirements Support deployment, rollback planning, production readiness, hypercare, operational handoff, and runbooks Define audit logging for authentication and authorization decisions, model changes, tuple changes, and policy exceptions Design support processes for access-denied issues, account recovery escalations, manual review, and fraud/security handoffs, and monitor authentication and authorization failures and customer impact trends And what you need to have: Hands-on fine-grained authorization experience (ReBAC, RBAC, ABAC, relationship tuples, policy evaluation, deny-by-default controls) Experience with Okta, Microsoft identity stack, or Ping in customer-facing applications 5+ years in IAM, CIAM, application security, digital identity, authorization engineering, or secure application integration Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (advanced degree or equivalent experience preferred) OAuth 2.0, OpenID Connect, SAML, MFA, tokens, claims, sessions, and secure account recovery API integration, distributed-system resilience, caching, logging, latency, and failure handling Privacy, consent, customer data segregation, auditability, and regulated financial services security expectations Ability to model complex customer, account, organizational, delegated, and household relationships Financial services or other regulated industry experience preferred Preferred certifications: CIAM, CISSP, CSSLP, CCSP, Microsoft identity, or Okta/Auth0; OAuth/OIDC, API security, cloud security, or application security credentials are beneficial No CTC or sponsorship at this time.