Head of Authentication Engineering

Madison-Davis; United States; À distance; USD 250 000 - 360 000; Plein temps

Résumé du poste

Madison-Davis, LLC is seeking a seasoned Head of Authentication Engineering to lead enterprise authentication across workforce systems, applications, APIs, and cloud environments. This role blends high-level technical direction with direct engineering people management.

You will define authentication architecture, guide modernization efforts, and raise secure identity standards for traditional apps and AI-enabled systems while remaining hands-on to coach engineers.

Qualifications

• 12+ years in IAM or related security engineering.
• 5+ years direct people management of engineering teams.
• Deep hands-on enterprise authentication architecture and implementation expertise.
• Strong knowledge of SAML, OAuth 2.0, OIDC, federation, SSO, MFA, and token security.
• Experience with PingFederate, PingAccess, PingOne, or comparable platforms.
• Experience implementing passwordless or phishing-resistant authentication.
• Strong API security, delegated authorization, PKI/mTLS, and machine identity knowledge.
• Experience supporting cloud and hybrid identity requirements.
• Bachelor's degree in a relevant technical field or equivalent practical experience.

Responsabilités

• Own enterprise authentication architecture, strategy, standards, and engineering roadmaps.
• Lead and develop a distributed authentication engineering team, including staffing, coaching, and technical oversight.
• Design and oversee SSO, MFA, federation, and authentication solutions using SAML 2.0, OAuth 2.0, and OIDC.
• Drive passwordless and phishing-resistant authentication initiatives, including FIDO2 and passkeys.
• Design authentication and authorization patterns for APIs, cloud workloads, service identities, and AI-enabled systems.
• Establish secure token management, delegation, session security, and certificate-based authentication practices.
• Improve authentication platform availability, scalability, monitoring, and incident response.
• Partner with cybersecurity, application engineering, cloud platforms, and architecture stakeholders on complex technical decisions.

Connaissances

IAM leadership

Auth architecture

SAML

OAuth2

OIDC

SSO

MFA

Passwordless

Federation

API security

PKI/mTLS

Machine identity

Staff management

Cloud identity

Security engineering

AI identity

Formation

Bachelor's degree

Outils

PingFederate

PingAccess

PingOne

SPIFFE/SPIRE

OPA

Cedar

ABAC

Description du poste

A large financial services organization is hiring an experienced Head of Authentication Engineering to lead its enterprise authentication capabilities across workforce systems, applications, APIs, and cloud environments. This position combines enterprise-wide technical leadership with direct engineering people management. The successful candidate will help define authentication architecture, guide modernization initiatives, improve security and reliability, and establish secure identity practices for traditional applications and emerging AI-enabled systems. The role requires a leader who remains technically engaged while providing architectural direction and coaching engineers.

RESPONSIBILITIES

• Own enterprise authentication architecture, strategy, standards, and engineering roadmaps.
• Lead and develop a distributed authentication engineering team, including staffing, coaching, and technical oversight.
• Design and oversee SSO, MFA, federation, and authentication solutions using SAML 2.0, OAuth 2.0, and OIDC.
• Drive passwordless and phishing-resistant authentication initiatives, including FIDO2 and passkeys.
• Design authentication and authorization patterns for APIs, cloud workloads, service identities, and AI-enabled systems.
• Establish secure token management, delegation, session security, and certificate-based authentication practices.
• Improve authentication platform availability, scalability, monitoring, and incident response.
• Partner with cybersecurity, application engineering, cloud platforms, and architecture stakeholders on complex technical decisions.

Role Requirements

• 12+ years of experience in IAM, authentication engineering, security engineering, or closely related technical disciplines.
• 5+ years of direct people management of engineering teams.
• Deep hands-on enterprise authentication architecture and implementation expertise.
• Strong knowledge of SAML, OAuth 2.0, OIDC, federation, SSO, MFA, and token/session security.
• Experience with enterprise access-management platforms such as PingFederate, PingAccess, PingOne, or comparable technologies.
• Experience implementing passwordless or phishing-resistant authentication.
• Strong API security, delegated authorization, PKI/mTLS, and machine identity knowledge.
• Experience supporting cloud and hybrid identity requirements.
• Understanding of authentication and authorization considerations for AI agents, non-human identities, and MCP-enabled integrations.
• Bachelor's degree in a relevant technical field or equivalent practical experience.

PREFERRED EXPERIENCE

• Financial services, insurance, or similarly regulated enterprise experience.
• SPIFFE/SPIRE or comparable workload identity standards.
• OPA, Cedar, ABAC, or advanced authorization patterns.
• Exposure to ID-JAG, CAEP, Transaction Tokens, or similar emerging standards.
• Relevant professional security or cloud certifications.