Lead, Infrastructure Security Engineer - Customer Identity & Access Management

Job Classification: Technology - Engineering & Cloud Are you interested in engineering secure, scalable, and intelligent identity platforms that protect millions of customer interactions? The Global Technology Security Services team is building the next generation of Customer Identity and Access Management capabilities through cloud identity platforms, adaptive authentication, fraud and risk detection, software engineering, automation, and modern authorization patterns. Your Team & Role   As a Lead Infrastructure Security Engineer on our CIAM Team, you will lead, design, develop, test, automate, and support security capabilities across the global CIAM ecosystem, with primary emphasis on PingOne Advanced Identity Cloud, PingOne Protect, customer authentication journeys, CIAM APIs, mobile and web integrations, fraud and risk controls, and platform observability. You will partner with Technical Leads, Product Owners, application engineers, mobile developers, fraud and cyber teams, architects, and delivery professionals to implement secure customer authentication, authorization, registration, account recovery, identity verification, and step-up authentication solutions. Here is What You Can Expect on a Typical Day Engineer advanced authentication, registration, account recovery, profile management, consent, and step-up MFA journeys using PingOne Advanced Identity Cloud. Develop and maintain custom journeys, custom nodes, JavaScript decision logic, validation rules, scripted policies, OIDC claims logic, API integrations, and reusable CIAM components. Customize and support PingOne AIC Hosted Pages, including branding, localization, frontend behavior, reusable themes, input validation, responsive user experiences, and accessibility compliance. Design and implement PingOne Protect capabilities within customer identity flows, including global and application-specific risk policies, standard and custom predictors, composite risk decisions, group mappings, device signals, behavioral signals, registration velocity, compromised credential indicators, and external fraud intelligence. Develop proactive fraud mitigation patterns that can dynamically allow, challenge, step up, throttle, block, or route a customer transaction for additional verification based on evaluated risk. Ability to work with various teams across the business such as  Cyber Fraud and business partners. The Skills & Expertise You Bring Qualifications Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related discipline, or equivalent professional experience demonstrating senior-level architecture and engineering depth. Typically 5 ½ or more years of progressive IAM, security engineering, software engineering, platform engineering, or cloud experience, delivering CIAM solutions leading complex technical designs or global application integrations. Demonstrated ownership of customer-facing identity solutions supporting high-volume web, native mobile, SPA, BFF, API, microservice, partner, call-center, and machine-to-machine channels across multiple regions, environments, and business units. Advanced hands-on expertise with PingOne Advanced Identity Cloud SAAS  including journey design, nested journeys, custom and scripted decision nodes, authentication levels, session configuration, hosted pages, identity schemas, managed objects, AM/IDM APIs, application policies, OIDC claims scripts, environment promotion, and production troubleshooting. Hands-on experience integrating PingOne Protect automating fraud detection, adaptive-authentication, device intelligence, behavioral analytics, bot detection, identity verification, and external risk signals; able to create predictors and composite policies, tune thresholds, interpret risk evidence, control false positives, and implement allow, challenge, step-up, throttle, block, or manual-review outcomes. Integrate and troubleshoot Ping journey and device-profiling SDKs in JavaScript, React Native, Android, iOS, and Flutter, including callback rendering, browser and deep-link redirects, PKCE verifier persistence, cookie behavior, device identifiers, CORS/CSP, network failures, application lifecycle transitions, token renewal, and diagnostic logging. Demonstrated ability to design and implement coarse- and fine-grained authorization using least-privilege scopes, granular business roles, entitlements, resource/action models, consent, relationship and contextual attributes, JWT access-token claims, policy decision points, policy enforcement points, obligations, deny-by-default behavior, and domain-service ownership boundaries. Strong production coding capability in at least two of Java, JavaScript/TypeScript, Python, Spring, Node.js, React, PowerShell, or shell, with evidence of writing maintainable modules, tests, API clients, migration utilities, validation tools, pipeline automation, operational scripts, and reusable platform accelerators. Advanced REST API engineering skills, including resource and contract design, HTTP semantics, JSON schemas, pagination, filtering, idempotency, retries, rate limits, webhooks and callbacks, authentication headers, error models, correlation IDs, backward compatibility, mocks, Postman collections, negative testing, and automated contract validation against PingOne AIC and downstream services. Strong Splunk and Dynatrace capability, including SPL, field extraction, nested JSON parsing, dashboards, service-level indicators, transaction correlation, alert design, baseline and threshold tuning, distributed tracing, latency segmentation, root-cause analysis, and privacy-aware handling of tokens, credentials, device data, and customer PII. Experience designing and executing high-volume identity and application migrations with batching, checkpointing, restartability, reconciliation, credential migration, schema mapping, exception queues, audit trails, rollback controls, cutover orchestration,