Customer Identity and Access Management Specialist

Farm Credit East; Enfield (CT); Hybrid; USD 85,000 - 105,000; Full time

Job summary

Farm Credit East is seeking a Customer Identity and Access Management Specialist to enable secure, privacy-conscious customer access across on‑premise and cloud ecosystems. You will own CIAM requirements, identity lifecycle, MFA, and authorization models, working with cross‑functional teams to deliver trusted access for customers and staff.

You will partner with digital portals and enterprise apps to ensure least-privilege decisions, testability, and auditable access, while balancing security

Qualifications

• This position requires a Bachelor's degree in IT, Cybersecurity, CS, or related field; advanced degree preferred.
• Minimum of 5 years of experience in IAM, CIAM, application security, or secure integration.
• Hands-on experience delivering customer authentication or fine-grained authorization for customer-facing apps.
• Certification in CIAM, CISSP, CSSLP, CCSP or equivalent is preferred.

Responsibilities

• Lead requirements for customer signup, login, MFA, recovery, linking, and identity proofing touchpoints.
• Define identity sources, attributes, lifecycle states, and dependencies for authorization design.
• Translate journeys into CIAM requirements and manage a delivery backlog with stakeholders.
• Design and review FGA/RAAC models and enforce least privilege and privacy by design.
• Coordinate with portal, CRM, integration teams to embed secure customer access.

Skills

IAM

CIAM

Application security

Digital identity

Authorization engineering

Secure application integration

OAuth/OIDC

API security

Cloud security

Okta/Auth0

Education

Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or related field

Advanced degree or equivalent experience preferred

Tools

Okta/Auth0

Cloud security tools

API security tooling

Job description

Select how often (in days) to receive an alert:

Customer Identity and Access Management Specialist

Be part of a team focused on enabling the success of Farm Credit East’s staff through world class technology support. Farm Credit East’s success is built on its ability to leverage technology and staff to provide a high-class customer and employee experience. This position provides staff the support and resources they need to provide the level of service Farm Credit East is known for. We are One Team Working Together with a focus on our five pillars: Outstanding Customer and Employee Experience, Quality Growth, Operational Excellence, Commitment to our Communities, and Protecting Customer Information.

The Customer Identity and Access Management Specialist serves as Farm Credit East’s subject matter expert for customer authentication, customer identity lifecycle, account linking, consent-aware access, and fine-grained authorization. The role defines and validates CIAM and FGA requirements, designs secure authorization models using relationship-based, role-based, and attribute-based controls, supports integration with the unified customer portal and enterprise applications, and ensures customer access decisions are least-privileged, resilient, privacy-aware, testable, and auditable.

T he value drivers for this role are as follows:

• Secure and Friction-Aware Customer Access
• Customer Data Segregation and Privacy
• Fine-Grained Authorization and Policy Governance
• Digital Portal Enablement
• Operational Resilience and Auditability

Duties and Responsibilities:

CIAM Product Delivery and Customer Identity Lifecycle

• Lead requirements analysis for customer signup, login, MFA, account recovery, account linking, identity proofing touchpoints, profile management, session and token handling, and high-risk transactions.
• Define customer identity sources, identifiers, identity correlation, account linking, customer and relationship attributes, lifecycle states, and dependencies needed before authorization design.
• Translate prioritized customer journeys, personas, channels, systems, and acceptance criteria into CIAM requirements and a managed delivery backlog.
• Partner with digital portal, Salesforce FSC, nCino, integration, data, customer support, privacy, fraud, and application teams to embed secure customer access.
• Balance security, privacy, accessibility, supportability, and customer experience when evaluating authentication and recovery controls.

Fine-Grained Authorization and Entitlement Engineering

• Design and review FGA authorization models, including resource types, relationships, inheritance, roles, attributes, permissions, policy rules and relationship tuples.
• Apply ReBAC, RBAC, and ABAC patterns to enforce customer-data segregation, least privilege, role/relationship rules, consent restrictions, and deny-by-default behavior.
• Define how FGA stores and check APIs integrate with the CIAM platform, token issuance, application sessions, data sources, and consuming applications.
• Establish policy ownership, approval, model promotion, versioning, exception, and change-governance processes.
• Review tuple generation, caching, latency, availability, failure handling, and fallback behavior to prevent unauthorized access during service degradation.

Integration, Migration, Testing and Release Readiness

• Provide oversight and governance for build and configuration of CIAM and FGA environments, models, APIs, initial tuples, data integrations, and application onboarding.
• Coordinate migration, reconciliation, and validation of customer identities, relationships entitlements, and authorization data.
• Develop and execute SIT, UAT, negative, regression, security, performance, resilience, and failure-mode tests; trace results to requirements and acceptance criteria.
• Validate policy simulation and authorization results for approved customer relationships, consent, sensitive data, and regulatory rules.
• Support deployment, rollback planning, production readiness, hypercare, operational handoff, runbooks, and defect remediation.

Security, Privacy, Support and Monitoring

• Review access-control gaps and authorization designs for customer-data segregation, privacy requirements, consent, logging, investigation, and complaint support.
• Define actionable audit logging for authentication and authorization decisions, model changes, tuple changes, policy exceptions, and administrative activity.
• Design support processes for access-denied issues, account recovery escalations, manual review, fraud/security handoffs, and customer-facing support guidance.
• Monitor authentication and authorization failures, policy anomalies, integrity issues, service health, and customer-impact trends; coordinate incident response and corrective action.

Job Qualifications and Requirements:

• This position requires a Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field required. Advanced degree or equivalent experience preferred.
• Minimum of 5 years of experience in IAM, CIAM, application security, digital identity, authorization engineering, or secure application integration.
• Hands-on experience delivering customer authentication or fine-grained authorization capabilities for customer-facing applications is required.
• Financial-services or other regulated-industry experience is preferred
• CIAM, CISSP, CSSLP, CCSP, Microsoft identity, Okta/Auth0, or equivalent certifications are preferred.
• OAuth/OIDC, API security, cloud security, or application security credentials are beneficial.
• We offer hybrid work options after two weeks of employment with Farm Credit East. Hybrid work options are determined based on job role and balancing the needs of the customers, the team, and individual work performance. This will be reviewed based on manager discretion.

Compensation and Benefits:

• Salary range: $85,000 - $105,000 commensurate with experience.
• Short Term Incentive to reward business results
• Retirement Contributions:
  • 401(k) match up to 6% of salary; or for those unable to take full advantage of the 401(k) match, verified student loan payments may qualify for an employer match in your 401(k) up to 6% of salary
  • Defined Contribution retirement plan funded at 2-9% of salary depending on years of service
• Time Off:
  • 15-25 days of vacation leave per year, depending on years of service
  • 12 days of holiday leave per year
  • 7.5 days of sick leave in your first year, followed by 12 days of sick leave per year thereafter; unlimited rollover of unused sick leave year to year
  • Paid Parental Leave: Up to 80 hours of paid leave for birthing, non-birthing, and adoptive parents
  • Family Care Leave: Additional leave options available under FMLA and company policy
• Health and Insurance:
  • Comprehensive medical, dental, and vision plans, including preventive care and wellness programs to support your overall health and well-being
  • Health Savings Account
  • Life insurance at 2x base pay
  • Accidental Death and Dismemberment insurance at 2x base pay
  • Long-term disability insurance at 2/3 base pay
• Additional Benefits:
  • Tuition reimbursement
  • Continuing education and training
  • Employee Assistance Program offering a wide variety of tools and resources
• Benefits Eligibility:
  • Eligibility Begins: First of the month following your hire date
  • Eligible Employees: Full-time employees working 30+ hours per week; Part-Time employees working 20+ hours per week.

Farm Credit East is an Equal Opportunity Employer. As an Equal Opportunity Employer, we do not discriminate on the basis of race, color, religion, national origin, sex, sexual orientation, gender identity, age, marital status, disability status, protected veteran status, genetic information or any other status protected by federal, state or local law. It is our goal to make employment decisions that further the principle of equal employment opportunity by utilizing objective standards based upon an individual's qualifications for a specific job opening. In compliance with the Americans with Disabilities Act (“ADA”), if you have a disability and would like a reasonable accommodation in order to apply for a position with Farm Credit East, please call 1-800-562-2235 or e-mail [e-mail] .