Principal CIAM Architect

Citizens Financial; United States; Hybrid; USD 180,000 - 260,000; Full time

Job summary

Citizens Financial seeks a Principal CIAM Architect to design and drive the Customer Identity and Authentication program. You will define target state architecture, standards, and integration patterns across authentication, federation, and identity services, partnering with multiple teams to translate strategy into scalable solutions.

This hybrid role emphasizes architecture leadership over hands-on coding, guiding engineering teams, validating security controls, and ensuring high availability

Qualifications

• Extensive experience designing enterprise Identity and Access Management or Customer Identity and Access Management architectures.
• Strong direct experience with customer facing identity and authentication platforms at enterprise scale.
• Architecture experience with major CIAM technologies such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra External ID or similar.
• Experience architecting Passwordless Authentication, Passkeys, MFA, Adaptive or Risk Based Authentication capabilities.
• Experience designing identity solutions for web, mobile and API based applications.
• Experience integrating identity with fraud signals, device intelligence or behavioral analytics.

Responsibilities

• Define and evolve the target state architecture for Citizens' CIAM ecosystem.
• Establish enterprise patterns and standards for authentication, federation, and identity lifecycle services.
• Develop architecture for modern authentication capabilities (Passkeys, Passwordless, MFA, Adaptive Authentication).
• Provide architectural leadership across CIAM platforms (Ping Identity, ForgeRock, Okta, Auth0, Entra ID).
• Define integration patterns for APIs, mobile experiences and customer facing services.
• Lead architecture decisions on identity orchestration, authentication journeys, session management and customer authorization.
• Ensure CIAM architecture meets availability, resilience, scalability, performance and security requirements.

Skills

Enterprise Architecture

Security Architecture

CIAM Strategy

OAuth 2.0/OIDC

Identity Federation

Passwordless Authentication

Tools

Ping Identity

ForgeRock

Okta

Auth0

Microsoft Entra ID

Job description

Principal Customer Identity Access Management "CIAM" Architect

Position Summary

The CIAM Architect will provide technical architecture and strategic leadership for Citizens' Customer Identity and Authentication platform, helping define and advance a modern, scalable, secure and customer focused identity ecosystem.This role will establish the target state architecture, technical standards and integration patterns supporting customer authentication, authorization, identity federation, identity orchestration and digital identity services across Citizens.The CIAM Architect will partner closely with Digital Identity, Security Engineering, Product Management, Enterprise Architecture, Application Architecture, Fraud, Risk and Technology teams to translate Citizens' customer identity strategy into scalable technical architecture.This is an architecture and technical strategy role rather than a traditional hands on engineering or platform operations position. The architect will provide technical direction to engineering teams responsible for implementation and operation of CIAM capabilities.

Work Arrangement: Hybrid - 4 days onsite, 1 remote in one of the following hubs: Johnston, RI | Boston, MA | Marlton, NJ | Phoenix, AZ | Irving, TX | Charlotte, NC

Primary Responsibilities

• Define and evolve the target state architecture for Citizens' Customer Identity and Authentication ecosystem.
• Establish enterprise architecture patterns and technical standards for customer authentication, authorization, federation, identity orchestration and identity lifecycle services.
• Develop architecture supporting modern authentication capabilities including Passkeys, Passwordless Authentication, Multifactor Authentication, Adaptive Authentication, Risk Based Authentication and Identity Federation.
• Provide architectural leadership across CIAM platforms and technologies including Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra ID or comparable enterprise identity platforms.
• Define architecture patterns using OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn and related identity standards.
• Partner with Product Management to translate the CIAM product strategy and roadmap into scalable technical architecture and platform capabilities.
• Partner with engineering teams to translate architectural direction into executable technology solutions while providing technical oversight through implementation.
• Define reusable integration patterns for digital applications, APIs, mobile experiences and other customer facing services connecting to centralized identity capabilities.
• Lead architecture decisions involving identity orchestration, authentication journeys, identity proofing, account recovery, session management and customer authorization.
• Establish architecture for integrating customer identity with fraud signals, device intelligence, behavioral analytics and risk based authentication capabilities.
• Ensure CIAM architecture supports high availability, resiliency, scalability, performance and security requirements for enterprise scale customer authentication.
• Evaluate existing identity technologies and recommend modernization, consolidation and migration strategies.
• Provide architectural guidance for cloud, hybrid and API based identity services.
• Partner with Enterprise Architecture, Security Architecture, application teams and technology leadership to ensure CIAM architecture aligns with Citizens enterprise technology and security standards.
• Identify architectural risks, technology dependencies and platform constraints and develop strategies to address them.
• Serve as a senior technical advisor for complex CIAM architecture, authentication and identity integration decisions.
• Evaluate emerging identity technologies and industry developments and recommend opportunities that advance Citizens' long term CIAM strategy.

Desired Experience

• Extensive experience designing enterprise Identity and Access Management or Customer Identity and Access Management architectures.
• Strong direct experience with customer facing identity and authentication platforms at enterprise scale.
• Architecture experience with one or more major CIAM technologies such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra External ID or comparable platforms.
• Deep understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn and modern identity federation standards.
• Experience architecting Passwordless Authentication, Passkeys, Multifactor Authentication, Adaptive Authentication or Risk Based Authentication capabilities.
• Experience designing identity solutions supporting web, mobile and API based digital applications.
• Experience with identity orchestration, identity proofing, customer authorization, session management and authentication journey architecture.
• Experience integrating identity architecture with fraud detection, risk signals, device intelligence or behavioral analytics.
• Strong understanding of Z