CIAM Engineer

avacone Switzerland; Basel; On-site; CHF 120,000 - 180,000; Full time

Job summary

avacone Switzerland is seeking a CIAM Engineer to design, build, and operate secure customer identity and access management services across web and mobile applications.

You will work with product, engineering, security, privacy, and platform teams to balance security, usability, and reliability through the identity lifecycle.

Qualifications

• Hands-on experience implementing and operating customer-facing identity services in production.
• Experience with at least one CIAM platform such as Auth0, Ping Identity, Microsoft Entra External ID, or AWS Cognito.
• Strong understanding of OAuth 2.0 and OpenID Connect, including PKCE, token validation, and session management.
• Experience implementing MFA, account recovery, and federation; troubleshooting authentication across apps, APIs, and idPs.
• Proficiency in one or more backend languages such as Java, C#, TypeScript, Python, or Go.
• Experience with automated testing, CI/CD, and production troubleshooting using logs and metrics.
• Ability to explain security vs. UX trade-offs to technical and non-technical stakeholders.

Responsibilities

• Design and implement customer identity journeys, including registration, identity verification, sign-in, MFA, account recovery, and deletion.
• Integrate web and mobile apps with CIAM platform using OIDC, OAuth 2.0, and SAML 2.0 where required.
• Configure and maintain authentication policies, federation connections, identity flows, and session/token settings.
• Implement controls against account takeover, credential stuffing, and automated abuse; work with teams to strengthen authentication.
• Build automated tests and deployment pipelines for identity services and platform configuration; support safe rollouts and rollbacks.
• Monitor authentication availability, latency, success rates; investigate incidents and address recurring failure modes.
• Partner with security and privacy teams to implement data controls like minimization, retention, deletion.
• Maintain technical documentation, integration guides, and runbooks for CIAM usage.

Skills

CIAM experience

OAuth 2.0 / OIDC

MFA implementation

Federation support

Programming languages

Job description

Role Overview

We are looking for a CIAM Engineer to design, build, and operate secure, reliable customer identity and access management services. You will help customers register, sign in, recover their accounts, and manage their security settings across web and mobile applications.

Role Overview

We are looking for a CIAM Engineer to design, build, and operate secure, reliable customer identity and access management services. You will help customers register, sign in, recover their accounts, and manage their security settings across web and mobile applications.

You will work with product, application engineering, security, privacy, and platform teams to balance security, usability, and operational reliability throughout the customer identity lifecycle.

Key Responsibilities

• Design and implement customer identity journeys, including registration, identity verification, sign-in, multi-factor authentication (MFA), account recovery, and account deletion.
• Integrate web and mobile applications with the CIAM platform using OpenID Connect (OIDC), OAuth 2.0, and SAML 2.0 where required.
• Configure and maintain authentication policies, federation connections, identity flows, and session and token settings.
• Implement controls against account takeover, credential stuffing, and automated abuse. Work with product and security teams to introduce stronger authentication where risk warrants it.
• Build automated tests and deployment pipelines for identity services and platform configuration. Support safe rollouts and rollbacks for changes that affect customer access.
• Monitor authentication availability, latency, and success rates. Investigate production incidents and address recurring failure modes.
• Partner with security and privacy teams to implement customer identity data controls, including data minimization, retention, and deletion.
• Maintain technical documentation, integration guides, and operational runbooks for teams that depend on the CIAM platform.

Requirements

Required Qualifications

• Hands-on experience implementing and operating customer-facing identity or authentication services in production.
• Practical experience with at least one CIAM platform, such as Auth0, Ping Identity, Microsoft Entra External ID, or AWS Cognito.
• Strong understanding of OAuth 2.0 and OpenID Connect, including Authorization Code with PKCE, token validation, and session management.
• Experience implementing MFA, account recovery, and federation. Ability to troubleshoot authentication failures across applications, APIs, and identity providers.
• Proficiency in at least one programming language used for backend or platform engineering, such as Java, C#, TypeScript, Python, or Go.
• Experience with automated testing, CI/CD, and production troubleshooting using logs and metrics.
• Ability to explain security and user experience trade-offs clearly and work with both technical and non-technical stakeholders.

Preferred Qualifications

• Experience implementing passkeys or other passwordless authentication using WebAuthn and FIDO2.
• Experience with risk-based authentication, bot mitigation, or account takeover detection.
• Experience migrating customer identities between platforms, including planning for credential continuity and staged cutovers.
• Experience managing identity platform configuration with infrastructure-as-code tools such as Terraform.
• Familiarity with privacy requirements for customer identity data, such as GDPR, and experience translating them into technical controls.