Staff Engineer - Infrastructure

Own CIAM design and implementation decisions for the team, guiding user story creation and refinement to ensure technical clarity and feasibility.

Help refine features into well-defined user stories and technical spikes; ensure stories are sized and scoped appropriately for team velocity and sprint capacity.

Guide sprint planning and backlog refinement, leading technical trade-off discussions that balance security, performance, and delivery timelines.

Write and review policy scripts, API integration code, and orchestration logic to implement identity flows and custom abstractions.

Provide hands-on code and configuration reviews, ensuring delivery aligns with definition of done, security standards, and engineering best practices.

Design and implement CIAM capabilities using Ping x ForgeRock products, including authentication flows (OAuth 2.0, OIDC, SAML), MFA, password less authentication, adaptive/risk-based authentication, identity federation, and user journey orchestration.

Configure and customize identity flows using Ping policies, orchestration rules, policy scripts, and SDKs to meet functional requirements.

Design, develop, and own a custom abstraction layer that simplifies Ping Identity integration, enabling application teams to implement secure identity patterns without deep platform expertise.

Own end-to-end integrations with web/mobile applications, backend APIs, and API gateways.

Evolve existing patterns to meet changing objectives.

Embed security by design in all CIAM implementations; partner with security teams on threat modeling, design reviews, fraud detection, and anomaly detection strategies.

Ensure CIAM solutions meet privacy, regulatory, and compliance requirements (OIDC, OAuth2, NIST, GDPR, CCPA, NYDFS).

Own non-functional requirements including performance targets, system resiliency, and availability SLAs.

Implement and maintain CI/CD pipelines for CIAM configuration and code using GitHub Actions, Jenkins, or similar tools.

Promote configuration-as-code and Infrastructure-as-Code (IaC) practices across CIAM delivery.

Support automated testing, logging, monitoring, and alerting for identity services to enable rapid incident detection.

Troubleshoot production issues and lead incident resolution in collaboration with SRE and platform teams, working toward rapid response times.

Mentor CIAM engineers and application developers on identity patterns, security best practices, and Ping platform capabilities through code reviews, pair sessions, and knowledge-sharing.

Serve as the CIAM technical authority for the Agile team, making feature/integration-level design decisions that unblock team members and keep momentum.

Create and maintain CIAM architecture documentation, integration guides, and decision records to support team knowledge and onboarding.

Collaborate with enterprise architects and product teams to align team-level CIAM solutions with broader organizational strategy and roadmaps.

Coordinate with Ping Identity vendor teams for platform guidance, technical support, and issue escalation as needed.

Required Qualifications

7–10+ years of professional experience in identity and access management (IAM), with a strong focus on Customer IAM (CIAM) design and implementation.

Hands-on experience with Ping Identity PingOne, ForgeRock, or similar IAM/CIAM platforms designing, configuring, and deploying CIAM solutions in production.

Deep knowledge of authentication and authorization standards: OAuth 2.0, OpenID Connect (OIDC), SAML, JWT, and REST API security patterns.

Proficiency in MFA, passwordless authentication strategies, identity federation, and risk-based authentication policies.

Experience deploying and managing CIAM solutions in cloud environments (AWS or GCP).

Proven experience designing and maintaining custom integration layers (SDKs, abstraction layers, or API wrappers) that simplify platform integration for downstream consumers.

Hands-on development and scripting proficiency in JavaScript, Java, Groovy, Python, or similar languages.

Experience designing and maintaining CI/CD pipelines using modern tools (GitHub Actions, Jenkins, or equivalent).

Familiarity with configuration-as-code and Infrastructure-as-Code (IaC) practices for identity platforms.

Strong understanding of application security principles, authentication/authorization threat models, and secure coding practices.

Proven experience working as a Senior or Lead Engineer, balancing hands-on technical execution with team leadership, mentoring, and technical decision-making in Agile environments.

Excellent communication and stakeholder management skills with Product Owners, Security teams, Enterprise Architects, and Engineering partners.

Demonstrated ability to lead technical discussions, resolve design trade-offs, and influence technical decisions across teams.

Preferred Qualifications

Experience migrating identity solutions from on-premises IAM platforms to cloud-based SaaS CIAM platforms.

Hands-on experience with ForgeRock Identity Cloud or other SaaS IAM platforms.

Experience designing and supporting mobile identity use cases (native apps, token lifecycle management, device trust).

Familiarity with API gateways, Web Application Firewalls (WAFs), and fraud detection/anomaly detection tools.

Relevant certifications: Ping Identity, ForgeRock, Cloud (AWS/GCP), or Information Security certifications.

Experience coordinating with IAM vendor teams for technical support, platform guidance, and strategic alignment.

About Us | Our Culture | What It’s Like to Work Here