Principal CIAM Architect

Citizens; Irving (TX); Hybrid; USD 170,000 - 210,000; Full time

Benefits offered by this job

Medical, dental and vision coverage

Retirement benefits

Paid time off

Maternity/paternity leave

Flexible work arrangements

Education reimbursement

Job summary

Citizens is seeking a Principal CIAM Architect to lead the strategy and technical direction for our Customer Identity and Authentication ecosystem. You will define target state architecture, standards, and integration patterns across authentication, authorization, federation and identity services.

Collaborating with Digital Identity, Security, Product, and Enterprise Architecture, you will drive modernization, ensure scalability and security, and provide senior technical guidance to engineering

Qualifications

• Extensive experience designing enterprise IAM or CIAM architectures.
• Strong direct experience with customer-facing identity platforms at enterprise scale.
• Architecture experience with major CIAM technologies such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra External ID or comparable platforms.
• Deep understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn and modern identity federation standards.
• Experience architecting Passwordless Authentication, Passkeys, Multifactor Authentication, Adaptive Authentication or Risk Based Authentication capabilities.
• Experience designing identity solutions for web, mobile and API-based digital applications.
• Experience with identity orchestration, identity proofing, customer authorization, session management and authentication journey architecture.
• Experience integrating identity architecture with fraud detection, risk signals, device intelligence or behavioral analytics.
• Strong understanding of Zero Trust architecture and modern identity security principles.
• Experience designing highly available and resilient identity platforms for large populations and high volumes.
• Experience in regulated enterprise environments, preferably financial services.
• Ability to influence architecture and engineering decisions across multiple teams without direct authority.

Responsibilities

• Define and evolve the target state CIAM architecture for Citizens' identity ecosystem.
• Establish patterns and standards for authentication, authorization, federation and life cycle services.
• Develop architecture for modern authentication capabilities including Passkeys and Passwordless.
• Provide architectural leadership across CIAM platforms (Ping, ForgeRock, Okta, Auth0, Entra ID).
• Define patterns using OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2 and WebAuthn.
• Partner with product management to translate CIAM strategy into scalable platform capabilities.
• Collaborate with engineering to implement architectural direction with technical oversight.
• Define reusable integration patterns for digital apps, APIs, mobile experiences.
• Lead decisions on identity orchestration, journeys, proofing, session management & authorization.
• Integrate identity with fraud signals, device intelligence and risk analytics.
• Ensure CIAM architecture meets HA, resiliency, performance and security requirements.
• Evaluate legacy identity tech; plan modernization, consolidation and migration.
• Provide guidance for cloud, hybrid and API-based identity services.
• Align with Citizens' security standards and enterprise architecture governance.
• Identify risks and dependencies; develop mitigations & roadmaps.
• Serve as senior advisor on CIAM architecture and identity integration decisions.
• Evaluate emerging identity tech and opportunities to advance CIAM strategy.

Skills

CIAM architecture

Enterprise IAM

OAuth 2.0 / OpenID Connect

Identity federation

Passwordless / Passkeys

Zero Trust

Security leadership

Cloud/hybrid identity

Cross-functional influence

Tools

Ping Identity

ForgeRock

Okta

Auth0

Microsoft Entra ID

Job description

Description

Principal Customer Identity Access Management "CIAM" Architect

Position Summary

The CIAM Architect will provide technical architecture and strategic leadership for Citizens' Customer Identity and Authentication platform, helping define and advance a modern, scalable, secure and customer focused identity ecosystem.

This role will establish the target state architecture, technical standards and integration patterns supporting customer authentication, authorization, identity federation, identity orchestration and digital identity services across Citizens.

The CIAM Architect will partner closely with Digital Identity, Security Engineering, Product Management, Enterprise Architecture, Application Architecture, Fraud, Risk and Technology teams to translate Citizens' customer identity strategy into scalable technical architecture.

This is an architecture and technical strategy role rather than a traditional hands on engineering or platform operations position. The architect will provide technical direction to engineering teams responsible for implementation and operation of CIAM capabilities.

Work Arrangement: Hybrid – 4 days onsite, 1 remote in one of the following hubs: Johnston, RI | Boston, MA | Marlton, NJ | Phoenix, AZ | Irving, TX | Charlotte, NC

Primary Responsibilities

• Define and evolve the target state architecture for Citizens' Customer Identity and Authentication ecosystem.
• Establish enterprise architecture patterns and technical standards for customer authentication, authorization, federation, identity orchestration and identity lifecycle services.
• Develop architecture supporting modern authentication capabilities including Passkeys, Passwordless Authentication, Multifactor Authentication, Adaptive Authentication, Risk Based Authentication and Identity Federation.
• Provide architectural leadership across CIAM platforms and technologies including Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra ID or comparable enterprise identity platforms.
• Define architecture patterns using OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn and related identity standards.
• Partner with Product Management to translate the CIAM product strategy and roadmap into scalable technical architecture and platform capabilities.
• Partner with engineering teams to translate architectural direction into executable technology solutions while providing technical oversight through implementation.
• Define reusable integration patterns for digital applications, APIs, mobile experiences and other customer facing services connecting to centralized identity capabilities.
• Lead architecture decisions involving identity orchestration, authentication journeys, identity proofing, account recovery, session management and customer authorization.
• Establish architecture for integrating customer identity with fraud signals, device intelligence, behavioral analytics and risk based authentication capabilities.
• Ensure CIAM architecture supports high availability, resiliency, scalability, performance and security requirements for enterprise scale customer authentication.
• Evaluate existing identity technologies and recommend modernization, consolidation and migration strategies.
• Provide architectural guidance for cloud, hybrid and API based identity services.
• Partner with Enterprise Architecture, Security Architecture, application teams and technology leadership to ensure CIAM architecture aligns with Citizens enterprise technology and security standards.
• Identify architectural risks, technology dependencies and platform constraints and develop strategies to address them.
• Serve as a senior technical advisor for complex CIAM architecture, authentication and identity integration decisions.
• Evaluate emerging identity technologies and industry developments and recommend opportunities that advance Citizens' long term CIAM strategy.

Desired Experience

• Extensive experience designing enterprise Identity and Access Management or Customer Identity and Access Management architectures.
• Strong direct experience with customer facing identity and authentication platforms at enterprise scale.
• Architecture experience with one or more major CIAM technologies such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra External ID or comparable platforms.
• Deep understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn and modern identity federation standards.
• Experience architecting Passwordless Authentication, Passkeys, Multifactor Authentication, Adaptive Authentication or Risk Based Authentication capabilities.
• Experience designing identity solutions supporting web, mobile and API based digital applications.
• Experience with identity orchestration, identity proofing, customer authorization, session management and authentication journey architecture.
• Experience integrating identity architecture with fraud detection, risk signals, device intelligence or behavioral analytics.
• Strong understanding of Zero Trust architecture and modern identity security principles.
• Experience designing highly available and resilient identity platforms supporting large customer populations and high transaction volumes.
• Experience operating within a highly regulated enterprise environment, preferably financial services.
• Demonstrated ability to translate business, product, security and customer requirements into enterprise architecture and technical standards.
• Strong ability to influence architecture and engineering decisions across multiple technology teams without relying on direct reporting authority.

Preferred Qualifications

• Financial services, banking, payments or other highly regulated industry experience.
• Experience modernizing or consolidating complex enterprise CIAM environments.
• Experience with cloud based identity architectures across Microsoft Azure or AWS environments.
• Experience establishing CIAM architecture standards, reference architectures and reusable integration patterns.
• Experience partnering with enterprise architecture governance or architecture review processes.

Work arrangement and location requirements should follow the approved Citizens posting language for the requisition.

Pay Transparency

The salary range for this position is $170,000 to $210,000 per year, plus an opportunity to earn additional incentive earnings. Actual pay is based on various factors including, but not limited to, the budget, work location, and relevant skills and experience.

We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more. Note, Citizens’ paid time off policy exceeds the mandatory, paid sick or paid time-away policy of every local and state jurisdiction in the United States. For an overview of our benefits, visit https://jobs.citizensbank.com/benefits.

Some job boards have started using jobseeker-reported data to estimate salary ranges for roles. If you apply and qualify for this role, a recruiter will discuss accurate pay guidance.

Equal Employment Opportunity

Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague’s or a dependent’s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.

Why Work for Us

At Citizens, you'll find a customer-centric culture built around helping our customers and giving back to our local communities. When you join our team, you are part of a supportive and collaborative workforce, with access to training and tools to accelerate your potential and maximize your career growth

Background Check

Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.