Senior Identity & Access Management (CIAM) Engineer

• The expected compensation range for this position is between $80,200 - $134,250.
• Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process.
• Bonus based on performance and eligibility target payout is 8% of annual salary paid out annually.
• Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement.
• In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan.

• 8+ years of overall IT experience with hands-on engineering or support background.
• 6+ years of IAM, access management, authentication, federation, or identity engineering experience.
• 4+ years of hands-on CIAM implementation or support experience for B2B, B2C, external customer, partner, or digital identity use cases.
• Hands-on experience with Okta Customer Identity Cloud/Auth0, Okta, Ping, ForgeRock, or comparable CIAM platform.
• Strong working knowledge of OAuth 2.0, OpenID Connect, SAML 2.0, JWT, SCIM, LDAP, REST APIs, SDKs, webhooks, and API security.
• Hands-on experience configuring CIAM applications, connections, identity providers, login/sign-up flows, redirect URIs, callback URLs, logout URLs, custom domains, and branding.
• Good understanding of OAuth/OIDC flows including Authorization Code with PKCE, Client Credentials, refresh tokens, scopes, claims, audiences, issuers, token validation, and token lifetime management.
• Experience integrating CIAM with single-page applications, mobile apps, backend APIs, portals, and partner-facing applications using vendor SDKs, REST APIs, and modern web frameworks.
• Experience configuring or supporting MFA, passwordless authentication, social login, enterprise federation, user registration, account recovery, profile management, and consent capture.
• Hands-on experience with custom claims, rules/actions/hooks, API permissions, RBAC, groups/roles, attribute mapping, and user metadata/profile attribute management.
• Experience troubleshooting CIAM issues related to redirects, SSO sessions, token errors, certificate/metadata mismatches, CORS, API authorization failures, login failures, and user provisioning issues.
• Understanding of CIAM security controls such as adaptive MFA, bot/credential attack protection, breached password detection, rate limits, tenant logs, suspicious activity monitoring, and audit logging.
• Hands-on scripting or development experience using Java, JavaScript, Node.js, React, Spring Boot, Python, PowerShell, or similar technologies.
• Experience with CI/CD, DevSecOps, Git, Terraform, Ansible, Jenkins, GitHub Actions, Azure DevOps, or comparable automation tools.
• Experience supporting production IAM or CIAM platforms, including monitoring, logging, incident support, root cause analysis, and performance troubleshooting.
• BS/BA degree in Computer Science, Information Security, Engineering, or equivalent work experience.
• Okta Certified Administrator preferred; Okta Certified Consultant, Okta Certified Developer, Auth0/Okta Customer Identity Cloud certification, or Ping/ForgeRock certification is a plus.
• CISSP, CIAM, CISM, or comparable security certification is a plus.

• Experience implementing enterprise CIAM solutions at scale.
• Hands-on experience with Okta Customer Identity Cloud/Auth0 capabilities such as Actions, Rules, Hooks, Organizations, Management API, attack protection, log streaming, and custom domains.
• Experience with Okta Identity Engine, Universal Directory, Lifecycle Management, Workflows, Administrative APIs, and application integration patterns.
• Exposure to Ping, ForgeRock, SiteMinder, Azure AD/Entra ID, AWS Cognito, or other identity platforms is preferred.
• Ability to support secure B2B and B2C identity models for large-volume customer environments, including retail, eCommerce, mobile, portal, or partner ecosystems.
• Good understanding of authentication and authorization patterns including SSO, federation, token exchange, refresh tokens, session management, scopes, claims, consent, and delegated authorization.
• Understanding of API gateways, microservices, REST integration, reverse proxies, load balancers, headers-based authentication, and secure API access patterns.
• Experience integrating CIAM with web applications, mobile applications, CRM, Salesforce, SAP, eCommerce platforms, directories, data platforms, or downstream business systems.
• Awareness of privacy and security requirements such as GDPR, CCPA, consent capture, data minimization, audit logging, and customer data protection.
• Experience with security controls such as risk-based authentication, adaptive MFA, bot mitigation, credential attack protection, suspicious activity detection, and passwordless authentication.
• Hands-on experience with Java, Node.js, JavaScript, React, Spring Boot, Python, PowerShell, SQL, and REST API development.
• Experience deploying or supporting identity solutions in AWS, Azure, or hybrid environments.
• Exposure to Docker, Kubernetes, Linux, Windows, middleware, Apache, and enterprise infrastructure components.
• Experience with Splunk, ELK, Prometheus, native CIAM logs, SIEM integrations, or operational dashboards.
• Experience creating reusable integration patterns, runbooks, standards, and technical documentation.
• Experience supporting application migrations from legacy IAM platforms to modern CIAM capabilities.
• Ability to troubleshoot complex issues while continuing to build deeper SME-level expertise.

Non-Technical skills:

• Strong communication skills with the ability to explain CIAM concepts to technical teams, application owners, and security partners.
• Self-starter who can analyze requirements, identify risks, propose solutions, and complete technical tasks with limited guidance.
• Strong analytical and problem-solving skills, especially during integration troubleshooting and production support.
• Ability to balance security, user experience, scalability, performance, compliance, and delivery timelines.
• Ability to work across global teams, vendors, cybersecurity, architecture, product, and application teams.
• Good documentation discipline, including integration guides, runbooks, standards, and operational handoff materials.
• Flexible and able to adapt to changing priorities in a fast-paced enterprise environment.

Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance.

All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status.

PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity

If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents.

View PepsiCo EEO Policy .

Please view our Pay Transparency Statement