Principal CIAM Architect

Citizens Bank•Phoenix, AZ

3d•$170,000 - $210,000•Hybrid

About The Position

The CIAM Architect provides technical architecture and strategic leadership for Citizens’ Customer Identity and Authentication platform, helping establish a modern, scalable, secure, and customer-focused identity ecosystem. The role defines target-state architecture, technical standards, and integration patterns for customer authentication, authorization, identity federation, identity orchestration, and digital identity services across Citizens. This architecture and technical strategy position partners with Digital Identity, Security Engineering, Product Management, Enterprise Architecture, Application Architecture, Fraud, Risk, and Technology teams to translate customer identity strategy into scalable technical architecture. The architect provides technical direction and oversight to engineering teams responsible for implementing and operating CIAM capabilities; it is not primarily a hands-on engineering or platform operations role. The position is hybrid, with four days onsite and one remote day, based in one of the listed hubs: Johnston, Rhode Island; Boston, Massachusetts; Marlton, New Jersey; Phoenix, Arizona; Irving, Texas; or Charlotte, North Carolina. The stated annual salary range is $170,000 to $210,000, with the opportunity for additional incentive earnings. Actual pay depends on factors including budget, work location, and relevant skills and experience.

Requirements

Extensive experience designing enterprise Identity and Access Management or Customer Identity and Access Management architectures.
Strong direct experience with customer-facing identity and authentication platforms at enterprise scale.
Architecture experience with one or more major CIAM technologies, such as Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra External ID, or comparable platforms.
Deep understanding of OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn, and modern identity federation standards.
Experience architecting passwordless authentication, Passkeys, multifactor authentication, adaptive authentication, or risk-based authentication capabilities.
Experience designing identity solutions for web, mobile, and API-based digital applications.
Experience with identity orchestration, identity proofing, customer authorization, session management, and authentication journey architecture.
Experience integrating identity architecture with fraud detection, risk signals, device intelligence, or behavioral analytics.
Strong understanding of Zero Trust architecture and modern identity security principles.
Experience designing highly available and resilient identity platforms that support large customer populations and high transaction volumes.
Experience working in a highly regulated enterprise environment, preferably financial services.
Demonstrated ability to translate business, product, security, and customer requirements into enterprise architecture and technical standards.
Strong ability to influence architecture and engineering decisions across multiple technology teams without direct reporting authority.

Nice To Haves

Financial services, banking, payments, or other highly regulated industry experience.
Experience modernizing or consolidating complex enterprise CIAM environments.
Experience with cloud-based identity architectures across Microsoft Azure or AWS environments.
Experience establishing CIAM architecture standards, reference architectures, and reusable integration patterns.
Experience partnering with enterprise architecture governance or architecture review processes.

Responsibilities

Define and evolve the target-state architecture for Citizens’ Customer Identity and Authentication ecosystem.
Establish enterprise architecture patterns and technical standards for customer authentication, authorization, federation, identity orchestration, and identity lifecycle services.
Develop architecture for Passkeys, passwordless authentication, multifactor authentication, adaptive authentication, risk-based authentication, and identity federation.
Provide architectural leadership across CIAM platforms and technologies, including Ping Identity, ForgeRock, Okta, Auth0, Microsoft Entra ID, or comparable platforms.
Define architecture patterns using OAuth 2.0, OpenID Connect, SAML, SCIM, FIDO2, WebAuthn, and related identity standards.
Partner with Product Management to translate CIAM product strategy and roadmaps into scalable technical architecture and platform capabilities.
Guide engineering teams in translating architectural direction into executable technology solutions and provide technical oversight through implementation.
Define reusable integration patterns for digital applications, APIs, mobile experiences, and other customer-facing services that connect to centralized identity capabilities.
Lead architecture decisions involving identity orchestration, authentication journeys, identity proofing, account recovery, session management, and customer authorization.
Establish architecture for integrating customer identity with fraud signals, device intelligence, behavioral analytics, and risk-based authentication capabilities.
Ensure CIAM architecture supports enterprise-scale high availability, resiliency, scalability, performance, and security requirements.
Evaluate existing identity technologies and recommend modernization, consolidation, and migration strategies.
Provide architectural guidance for cloud, hybrid, and API-based identity services.
Partner with Enterprise Architecture, Security Architecture, application teams, and technology leadership to align CIAM architecture with Citizens’ enterprise technology and security standards.
Identify architectural risks, technology dependencies, and platform constraints, and develop strategies to address them.
Serve as a senior technical advisor for complex CIAM architecture, authentication, and identity integration decisions.
Evaluate emerging identity technologies and industry developments and recommend opportunities to advance Citizens’ long-term CIAM strategy.