IAM Engineer

Tradeweb; Bengaluru; On-site; INR 1,200,000 - 1,600,000; Full time

Job summary

Tradeweb is seeking a Senior IAM Engineer to join its Identity & Access Management team in Bengaluru, India. The role focuses on engineering and supporting client identity and authentication capabilities, ensuring secure, scalable access. Candidates should have 5+ years of experience with OIDC and OAuth 2.0 and must be able to troubleshoot complex identity issues. Responsibilities include managing client identity flows and implementing strong authentication patterns. The company promotes a culture of innovation and collaboration.

Qualifications

• 5+ years of experience in Identity and Access Management.
• Strong hands-on experience with OIDC and OAuth 2.0.
• Familiarity with security and compliance expectations in regulated environments.

Responsibilities

• Design, implement, and operate CIAM capabilities for client-facing applications.
• Build and support federated authentication using OIDC and OAuth 2.0.
• Own client identity flows such as registration, login, and account linking.

Skills

Identity and Access Management

SSO and modern authentication

OIDC and OAuth 2.0

MFA implementation

Troubleshooting complex systems

Technical documentation

Education

Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, or related field

Tools

Python

SQL

PowerShell

Confluence

Lucidchart/Visio

Job description

Job Description

Tradeweb Markets is a world leader in the evolution of electronic trading. A fintech company serving approximately 2,500 clients – including the world’s largest banks, asset managers, hedge funds, insurance companies, wealth managers and retail clients – in more than 65 countries across the globe. Since our first trade in 1998, we have helped transform and electronify the fixed‑income markets. Tradeweb is a culture built on innovation, creativity and collaboration. Mission: Move first and never stop. Collaborate with clients to create and build solutions that drive efficiency, connectivity, and transparency in electronic trading.

Tradeweb Markets LLC (Tradeweb) is proud to be an EEO Minorities/Females/Protected Veterans/Disabled/Affirmative Action Employer. https://www.dol.gov/ofccp/regs/compliance/posters/pdf/eeopost.pdf

Group Details

To support our continued growth, we are seeking a results‑driven Senior IAM Engineer to join our Identity & Access Management team. This role will engineer and support client identity and authentication capabilities for the products our clients use, delivering secure, scalable, and auditable access. The ideal candidate will design, implement, and troubleshoot client authentication and federation integrations using SAML 2.0, OIDC, and OAuth 2.0, including hands‑on details such as claims/token design, JWKS and key rotation, session management, and secure integration patterns. Financial services experience and familiarity with SOX/GLBA/FFIEC are strongly preferred.

Job Responsibilities

• Design, implement, and operate CIAM capabilities for client‑facing applications, balancing security, scalability, and user experience.
• Build and support federated authentication and authorization using OIDC and OAuth 2.0 (and SAML where required), including client configuration, scopes, consent, redirect‑URI strategy, and token/claims design.
• Own client identity flows such as registration, login, account linking, progressive profiling, and self‑service account recovery, including secure handling of email/phone verification.
• Implement strong authentication patterns for clients, including MFA, step‑up authentication, risk‑based/conditional access, and session‑management controls.
• Integrate applications using modern provisioning and identity lifecycle patterns such as JIT provisioning and SCIM where applicable to client/partner ecosystems.
• Define and enforce CIAM security standards: secure token lifetimes/refresh strategies, PKCE, key rotation/JWKS, secrets management, and protection against common auth attacks (replay, token theft, redirect abuse).
• Partner with product and engineering teams to standardize CIAM integration patterns and embed identity into application architecture (roles/permissions, fine‑grained authorization, and least privilege).
• Troubleshoot complex production issues across the auth stack (tokens, redirects, cookies/sessions, upstream IdPs), drive root‑cause analysis, and implement durable fixes.
• Instrument and monitor CIAM services and client auth journeys (logging, metrics, alerting), improving reliability, latency, and conversion while maintaining security.
• Produce and maintain technical documentation and runbooks for CIAM integrations and operational processes, supporting audits and incident response.
• Support compliance and risk requirements by enabling evidence collection and reporting around authentication events, policy enforcement, and access anomalies.

Required Qualifications

• Bachelor’s degree in Information Systems, Computer Science, Cybersecurity, or a related field (or equivalent practical experience).
• 5+ years of experience in Identity and Access Management, with strong expertise in SSO and modern authentication for client‑facing applications.
• Strong, hands‑on experience with OIDC and OAuth 2.0 (and SAML where required), including token/claims design, scopes, PKCE, redirect‑URI strategy, and key management (JWKS, rotation).
• Experience designing and implementing end‑to‑end CIAM journeys: registration, login, account recovery, progressive profiling, and account linking.
• Experience implementing modern authentication controls such as MFA, step‑up authentication, conditional/risk‑based access, and secure session management.
• Working knowledge of user lifecycle automation patterns for client/partner ecosystems, including JIT provisioning and SCIM where applicable.
• Ability to troubleshoot complex identity issues across distributed systems (cookies/sessions, redirects, tokens, upstream IdPs), perform root‑cause analysis, and drive durable remediation.
• Familiarity with security and compliance expectations in regulated environments (e.g., SOX, ISO 27001, NIST, GLBA) and how they influence authentication, logging, and access controls.
• Strong written and verbal communication skills, with the ability to translate between product, engineering, security, and compliance stakeholders.
• Experience producing clear technical documentation and diagrams (e.g., Confluence, Lucidchart/Visio), including integration runbooks, sequence flows, and configuration standards.
• Highly organized and detail‑oriented, with the ability to manage multiple concurrent integrations and production support priorities.

Preferred Qualifications

• Proven experience leading or significantly contributing to enterprise‑scale SSO/authentication initiatives, including rollout planning, migration/cutover strategies, and production hardening.
• Deep hands‑on experience implementing and operating complex federation patterns, including custom OIDC/OAuth configurations (scopes, policies, claims), SAML metadata/certificate management, and advanced sign‑in policies (conditional access, step‑up/MFA).
• Experience designing and implementing authorization frameworks, including RBAC/ABAC, policy‑based access control, permission modeling, and standards such as OAuth scopes, OIDC claims, and (where applicable) UMA or OPA‑style policy engines.
• Strong proficiency in scripting or programming for IAM/SSO automation and troubleshooting, using languages such as Python or Go, as well as tools like SQL or PowerShell (e.g., log analysis, token/claim validation, configuration automation).