Lead Infrastructure Security Engineer - Customer Identity & Access Management

Job Classification:

Technology - Engineering & Cloud

Are you interested in engineering secure, scalable, and intelligent identity platforms that protect millions of customer interactions? The Global Technology Security Services team is building the next generation of Customer Identity and Access Management capabilities through cloud identity platforms, adaptive authentication, fraud and risk detection, software engineering, automation, and modern authorization patterns.

Your Team & Role 

As a Lead Infrastructure Security Engineer on our CIAM Team, you will lead, design, develop, test, automate, and support security capabilities across the global CIAM ecosystem, with primary emphasis on PingOne Advanced Identity Cloud, PingOne Protect, customer authentication journeys, CIAM APIs, mobile and web integrations, fraud and risk controls, and platform observability. You will partner with Technical Leads, Product Owners, application engineers, mobile developers, fraud and cyber teams, architects, and delivery professionals to implement secure customer authentication, authorization, registration, account recovery, identity verification, and step-up authentication solutions.

Here is What You Can Expect on a Typical Day

• Engineer advanced authentication, registration, account recovery, profile management, consent, and step-up MFA journeys using PingOne Advanced Identity Cloud.
• Develop and maintain custom journeys, custom nodes, JavaScript decision logic, validation rules, scripted policies, OIDC claims logic, API integrations, and reusable CIAM components.
• Customize and support PingOne AIC Hosted Pages, including branding, localization, frontend behavior, reusable themes, input validation, responsive user experiences, and accessibility compliance.
• Design and implement PingOne Protect capabilities within customer identity flows, including global and application-specific risk policies, standard and custom predictors, composite risk decisions, group mappings, device signals, behavioral signals, registration velocity, compromised credential indicators, and external fraud intelligence.
• Develop proactive fraud mitigation patterns that can dynamically allow, challenge, step up, throttle, block, or route a customer transaction for additional verification based on evaluated risk.
• Ability to work with various teams across the business such as  Cyber Fraud and business partners.

The Skills & Expertise You Bring

Qualifications

• Bachelor’s degree in Computer Science, Software Engineering, Cybersecurity, Information Systems, or a related discipline, or equivalent professional experience demonstrating senior-level architecture and engineering depth.
• Typically 5 ½ or more years of progressive IAM, security engineering, software engineering, platform engineering, or cloud experience, delivering CIAM solutions leading complex technical designs or global application integrations.
• Demonstrated ownership of customer-facing identity solutions supporting high-volume web, native mobile, SPA, BFF, API, microservice, partner, call-center, and machine-to-machine channels across multiple regions, environments, and business units.
• Advanced hands-on expertise with PingOne Advanced Identity Cloud SAAS  including journey design, nested journeys, custom and scripted decision nodes, authentication levels, session configuration, hosted pages, identity schemas, managed objects, AM/IDM APIs, application policies, OIDC claims scripts, environment promotion, and production troubleshooting.
• Hands-on experience integrating PingOne Protect automating fraud detection, adaptive-authentication, device intelligence, behavioral analytics, bot detection, identity verification, and external risk signals; able to create predictors and composite policies, tune thresholds, interpret risk evidence, control false positives, and implement allow, challenge, step-up, throttle, block, or manual-review outcomes.
• Integrate and troubleshoot Ping journey and device-profiling SDKs in JavaScript, React Native, Android, iOS, and Flutter, including callback rendering, browser and deep-link redirects, PKCE verifier persistence, cookie behavior, device identifiers, CORS/CSP, network failures, application lifecycle transitions, token renewal, and diagnostic logging.
• Demonstrated ability to design and implement coarse- and fine-grained authorization using least-privilege scopes, granular business roles, entitlements, resource/action models, consent, relationship and contextual attributes, JWT access-token claims, policy decision points, policy enforcement points, obligations, deny-by-default behavior, and domain-service ownership boundaries.
• Strong production coding capability in at least two of Java, JavaScript/TypeScript, Python, Spring, Node.js, React, PowerShell, or shell, with evidence of writing maintainable modules, tests, API clients, migration utilities, validation tools, pipeline automation, operational scripts, and reusable platform accelerators.
• Advanced REST API engineering skills, including resource and contract design, HTTP semantics, JSON schemas, pagination, filtering, idempotency, retries, rate limits, webhooks and callbacks, authentication headers, error models, correlation IDs, backward compatibility, mocks, Postman collections, negative testing, and automated contract validation against PingOne AIC and downstream services.
• Strong Splunk and Dynatrace capability, including SPL, field extraction, nested JSON parsing, dashboards, service-level indicators, transaction correlation, alert design, baseline and threshold tuning, distributed tracing, latency segmentation, root-cause analysis, and privacy-aware handling of tokens, credentials, device data, and customer PII.
• Experience designing and executing high-volume identity and application migrations with batching, checkpointing, restartability, reconciliation, credential migration, schema mapping, exception queues, audit trails, rollback controls, cutover orchestration, coexistence, performance testing, and post-migration verification.
• Proven CIAM architecture leadership, including facilitation of discovery and whiteboarding sessions with global application, product, domain-service, fraud, cyber, privacy, cloud, network, operations, and vendor teams; able to uncover missing requirements, distinguish an existing pattern from a net-new pattern, challenge unsafe assumptions, and drive decisions to closure.
• Demonstrated ability to understand customer and business-service processes—registration, authentication, servicing, profile management, account recovery, consent, identity proofing, fraud review, partner access, entitlement, and downstream data access—and translate them into actors, trust boundaries, service ownership, authentication and authorization flows, API contracts, claims, controls, exceptions, and measurable outcomes.
• Proven delivery leadership under aggressive timelines: rapidly identify the minimum safe scope, reuse approved patterns, size complexity, sequence dependencies, time-box decisions, expose critical-path risks, define accountable owners, create sprint-ready acceptance criteria, secure architecture approvals, and drive work through testing, operational readiness, production release, and stabilization.
• Ability to operate independently in ambiguity, develop proof-of-concept code and measurable evidence, compare architecture options, document assumptions and trade-offs, make a clear recommendation, escalate unresolved risk, and remain directly engaged through implementation and production validation.
• Excellent written, verbal, and executive communication skills, including the ability to lead code and design reviews, challenge senior technical stakeholders constructively, explain complex identity and fraud risks in business terms, define precise ownership boundaries, and communicate decisions, residual risk, delivery status, and required actions without ambiguity.

Preferred evidence of qualification: Candidates should be prepared to discuss and demonstrate a production implementation they personally designed and delivered, including a PingOne AIC journey or OAuth client, a complete Ping Identity Gateway route with conditions and Chain filters, an AWS EKS deployment through CI/CD, Route 53 and ALB traffic flow, granular scopes or roles and JWT claims, automated negative tests, observability, failure diagnosis, and the architecture decisions used to balance security, customer experience, reuse, and delivery urgency.

Success in This Role

Success will be measured by the engineer’s ability to deliver secure and reusable CIAM capabilities; reduce fraud exposure and customer friction; automate platform operations; accelerate application onboarding; improve observability and incident resolution; strengthen engineering quality; and convert emerging customer identity risks into actionable technical controls.

You’ll Love Working Here Because You Can  

Join a team and culture where your voice matters; where every day, your work transforms our experiences to make lives better. As you put your skills to use, we’ll help you make an even bigger impact with learning experiences that can grow your technical AND leadership capabilities. You’ll be surprised by what this rock-solid organization has in store for you. 

What we offer you:

Prudential is required by state specific laws to include the salary range for this role when hiring a resident in applicable locations. The salary range for this role is from $133,600.00 to $220,400.00. Specific pricing for the role may vary within the above range based on many factors including geographic location, candidate experience, and skills.

• Market competitive base salaries, with a yearly bonus potential at every level. 
• Medical, dental, vision, life insurance, disability insurance, Paid Time Off (PTO), and leave of absences, such as parental and military leave. 
• 401(k) plan with company match (up to 4%). 
• Company-funded pension plan. 
• Wellness Programs including up to $1,600 a year for reimbursement of items purchased to support personal wellbeing needs. 
• Work/Life Resources to help support topics such as parenting, housing, senior care, finances, pets, legal matters, education, emotional and mental health, and career development.  
• Education Benefit to help finance traditional college enrollment toward obtaining an approved degree and many accredited certificate programs.  
• Employee Stock Purchase Plan: Shares can be purchased at 85% of the lower of two prices (Beginning or End of the purchase period).

Eligibility to participate in a discretionary annual incentive program is subject to the rules governing the program, whereby an award, if any, depends on various factors including, without limitation, individual and organizational performance. To find out more about our Total Rewards package, visit Work Life Balance | Prudential Careers. Some of the above benefits may not apply to part-time employees scheduled to work less than 20 hours per week.  

Prudential Financial, Inc. of the United States is not affiliated with Prudential plc. which is headquartered in the United Kingdom. 

Prudential is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, ancestry, sex, sexual orientation, gender identity, national origin, genetics, disability, marital status, age, veteran status, domestic partner status, medical condition or any other characteristic protected by law. 

To maintain the integrity and security of our hiring process, Prudential may use identity verification technologies. Your consent will be obtained before any verification takes place.

If you need an accommodation to complete the application process, please email [email protected]. 

If you are experiencing a technical issue with your application or an assessment, please email [email protected] to request assistance.