Lead, Infrastructure Security Engineer Customer Identity & Access Management

Job Classification:

Technology - Engineering & Cloud

Are you interested in engineering secure scalable and intelligent identity platforms that protect millions of customer interactions The Global Technology Security Services team is building the next generation of Customer Identity and Access Management capabilities through cloud identity platforms adaptive authentication fraud and risk detection software engineering automation and modern authorization patterns.

Your Team & Role

As a Lead Infrastructure Security Engineer on our CIAM Team you will lead design develop test automate and support security capabilities across the global CIAM ecosystem with primary emphasis on PingOne Advanced Identity Cloud PingOne Protect customer authentication journeys CIAM APIs mobile and web integrations fraud and risk controls and platform observability. You will partner with Technical Leads Product Owners application engineers mobile developers fraud and cyber teams architects and delivery professionals to implement secure customer authentication authorization registration account recovery identity verification and step-up authentication solutions.

Here is What You Can Expect on a Typical Day

• Engineer advanced authentication registration account recovery profile management consent and step-up MFA journeys using PingOne Advanced Identity Cloud.
• Develop and maintain custom journeys custom nodes JavaScript decision logic validation rules scripted policies OIDC claims logic API integrations and reusable CIAM components.
• Customize and support PingOne AIC Hosted Pages including branding localization frontend behavior reusable themes input validation responsive user experiences and accessibility compliance.
• Design and implement PingOne Protect capabilities within customer identity flows including global and application-specific risk policies standard and custom predictors composite risk decisions group mappings device signals behavioral signals registration velocity compromised credential indicators and external fraud intelligence.
• Develop proactive fraud mitigation patterns that can dynamically allow challenge step up throttle block or route a customer transaction for additional verification based on evaluated risk.
• Ability to work with various teams across the business such as Cyber Fraud and business partners.

The Skills & Expertise You Bring

Qualifications

• Bachelors degree in Computer Science Software Engineering Cybersecurity Information Systems or a related discipline or equivalent professional experience demonstrating senior-level architecture and engineering depth.
• Typically 5 ½ or more years of progressive IAM security engineering software engineering platform engineering or cloud experience delivering CIAM solutions leading complex technical designs or global application integrations.
• Demonstrated ownership of customer-facing identity solutions supporting high-volume web native mobile SPA BFF API microservice partner call-center and machine-to-machine channels across multiple regions environments and business units.
• Advanced hands-on expertise with PingOne Advanced Identity Cloud SAAS including journey design nested journeys custom and scripted decision nodes authentication levels session configuration hosted pages identity schemas managed objects AM/IDM APIs application policies OIDC claims scripts environment promotion and production troubleshooting.
• Hands-on experience integrating PingOne Protect automating fraud detection adaptive-authentication device intelligence behavioral analytics bot detection identity verification and external risk signals; able to create predictors and composite policies tune thresholds interpret risk evidence control false positives and implement allow challenge step-up throttle block or manual-review outcomes.
• Integrate and troubleshoot Ping journey and device-profiling SDKs in JavaScript React Native Android iOS and Flutter including callback rendering browser and deep-link redirects PKCE verifier persistence cookie behavior device identifiers CORS/CSP network failures application lifecycle transitions token renewal and diagnostic logging.
• Demonstrated ability to design and implement coarse- and fine-grained authorization using least-privilege scopes granular business roles entitlements resource/action models consent relationship and contextual attributes JWT access-token claims policy decision points policy enforcement points obligations deny-by-default behavior and domain-service ownership boundaries.
• Strong production coding capability in at least two of Java JavaScript/TypeScript Python Spring React PowerShell or shell with evidence of writing maintainable modules tests API clients migration utilities validation tools pipeline automation operational scripts and reusable platform accelerators.
• Advanced REST API engineering skills including resource and contract design semantics JSON schemas pagination filtering idempotency retries rate limits webhooks and callbacks authentication headers error models correlation IDs backward compatibility mocks Postman collections negative testing and automated contract validation against PingOne AIC and downstream services.
• Strong Splunk and Dynatrace capability including SPL field extraction nested JSON parsing dashboards service-level indicators transaction correlation alert design baseline and threshold tuning distributed tracing latency segmentation root-cause analysis and privacy-aware handling of tokens credentials device data and customer PII.
• Experience designing and executing high-volume identity and application migrations with batching checkpointing restartability reconciliation credential migration schema mapping exception queues audit trails rollback controls cutover orchestration coexistence performance testing and post-migration verification.
• Proven CIAM architecture leadership including facilitation of discovery and whiteboarding sessions with global application product domain-service fraud cyber privacy cloud network operations and vendor teams; able to uncover missing requirements distinguish an existing pattern from a net-new pattern challenge unsafe assumptions and drive decisions to closure.
• Demonstrated ability to understand customer and business-service processesregistration authentication servicing profile management account recovery consent identity proofing fraud review partner access entitlement and downstream data accessand translate them into actors trust boundaries service ownership authentication and authorization flows API contracts claims controls exceptions and measurable outcomes.
• Proven delivery leadership under aggressive timelines: rapidly identify the minimum safe scope reuse approved patterns size complexity sequence dependencies time-box decisions expose critical-path risks define accountable owners create sprint-ready acceptance criteria secure architecture approvals and drive work through testing operational readiness production release and stabilization.
• Ability to operate independently in ambiguity develop proof-of-concept code and measurable evidence compare architecture options document assumptions and trade-offs make a clear recommendation escalate unresolved risk and remain directly engaged through implementation and production validation.
• Excellent written verbal and executive communication skills including the ability to lead code and design reviews challenge senior technical stakeholders constructively explain complex identity and fraud risks in business terms define precise ownership boundaries and communicate decisions residual risk delivery status and required actions without ambiguity.

Preferred evidence of qualification: Candidates should be prepared to discuss and demonstrate a production implementation they personally designed and delivered including a PingOne AIC journey or OAuth client a complete Ping Identity Gateway route with conditions and Chain filters an AWS EKS deployment through CI/CD Route 53 and ALB traffic flow granular scopes or roles and JWT claims automated negative tests observability failure diagnosis and the architecture decisions used to balance security customer experience reuse and delivery urgency.

Success in This Role

Success will be measured by the engineers ability to deliver secure and reusable CIAM capabilities; reduce fraud exposure and customer friction; automate platform operations; accelerate application onboarding; improve observability and incident resolution; strengthen engineering quality; and convert emerging customer identity risks into actionable technical controls.

Youll Love Working Here Because You Can

Join a team and culture where your voice matters; where every day your work transforms our experiences to make lives better. As you put your skills to use well help you make an even bigger impact with learning experiences that can grow your technical AND leadership capabilities. Youll be surprised by what this rock-solid organization has in store for you.

What we offer you:

Prudential is required by state specific laws to include the salary range for this role when hiring a resident in applicable locations. The salary range for this role is from $133600.00 to $220400.00. Specific pricing for the role may vary within the above range based on many factors including geographic location candidate experience and skills.

• Market competitive base salaries with a yearly bonus potential at every level.
• Medical dental vision life insurance disability insurance Paid Time Off (PTO) and leave of absences such as parental and military leave.
• 401(k) plan with company match (up to 4%).
• Company-funded pension plan.
• Wellness Programs including up to $1600 a year for reimbursement of items purchased to support personal wellbeing needs.
• Work/Life Resources to help support topics such as parenting housing senior care finances pets legal matters education emotional and mental health and career development.
• Education Benefit to help finance traditional college enrollment toward obtaining an approved degree and many accredited certificate programs.
• Employee Stock Purchase Plan: Shares can be purchased at 85% of the lower of two prices (Beginning or End of the purchase period).

Eligibility to participate in a discretionary annual incentive program is subject to the rules governing the program whereby an award if any depends on various factors including without limitation individual and organizational performance. To find out more about our Total Rewards package visit Work Life Balance Prudential Careers. Some of the above benefits may not apply to part-time employees scheduled to work less than 20 hours per week.

Prudential Financial Inc. of the United States is not affiliated with Prudential plc. which is headquartered in the United Kingdom.

Prudential is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race color religion national origin ancestry sex sexual orientation gender identity national origin genetics disability marital status age veteran status domestic partner status medical condition or any other characteristic protected by law.

To maintain the integrity and security of our hiring process Prudential may use identity verification technologies. Your consent will be obtained before any verification takes place.

If you need an accommodation to complete the application process please email .

If you are experiencing a technical issue with your application or an assessment please email to request assistance.

Required Experience:

IC