Customer Identity and Access Management Specialist. This role is the subject matter expert for customer identity and fine-grained authorization on a new customer portal that brings CRM data, online banking, and a mobile app to customers. Large customer entities have many individuals who need different access across lending, bookkeeping, tax preparation, and estate planning, along with delegated access for outside CPAs and advisors.
The specialist plans and orchestrates that authorization model with the business and a global consulting firm, and ensures customer access decisions stay least-privileged, privacy-aware, testable, and auditable.
Compensation:
$60 to $85 per hour, W-2, flex depending on experience
Logistics:
Contract to hire. Hybrid for candidates within roughly 3 hours' drive of Connecticut, with onsite visits for key meetings and rollouts(lodging covered)
Here's what you'll be doing:
Plan and orchestrate fine-grained authorization with the business, key stakeholders, and the implementation partner
Design and review FGA models, including resource types, relationships, inheritance, roles, attributes, permissions, policy rules, and relationship tuples
Apply ReBAC, RBAC, and ABAC patterns to enforce customer data segregation, least privilege, consent restrictions, and deny-by-default behavior
Model multi-individual business customers, delegated access for external CPAs and financial planners, and different access by service line
Lead requirements for customer signup, login, MFA, account recovery, account linking, identity proofing touchpoints, profile management, session and token handling, and high-risk transactions
Define customer identity sources, identifiers, correlation, account linking, relationship attributes, and lifecycle states ahead of authorization design
Translate customer journeys, personas, channels, and acceptance criteria into CIAM requirements and a managed delivery backlog
Partner with digital portal, Salesforce, banking platform, integration, data, customer support, privacy, fraud, and application teams to embed secure customer access
Contribute to the CIAM and FGA platform evaluation (Ping and Okta are the leading candidates)
Define how FGA stores and check APIs integrate with the CIAM platform, token issuance, application sessions, data sources, and consuming applications
Establish policy ownership, approval, model promotion, versioning, exception, and change governance
Review tuple generation, caching, latency, availability, failure handling, and fallback behavior so service degradation never opens unauthorized access
Oversee build and configuration of CIAM and FGA environments, and coordinate migration, reconciliation, and validation of customer identities, relationships, and authorization data
Develop and execute SIT, UAT, negative, regression, security, performance, resilience, and failure-mode tests traced to requirements
Support deployment, rollback planning, production readiness, hypercare, operational handoff, and runbooks
Define audit logging for authentication and authorization decisions, model changes, tuple changes, and policy exceptions
Design support processes for access-denied issues, account recovery escalations, manual review, and fraud/security handoffs, and monitor authentication and authorization failures and customer impact trends
And what you need to have:
Hands-on fine-grained authorization experience (ReBAC, RBAC, ABAC, relationship tuples, policy evaluation, deny-by-default controls)
Experience with Okta, Microsoft identity stack, or Ping in customer-facing applications
5+ years in IAM, CIAM, application security, digital identity, authorization engineering, or secure application integration
Bachelor's degree in Information Technology, Cybersecurity, Computer Science, or a related field (advanced degree or equivalent experience preferred)
OAuth 2.0, OpenID Connect, SAML, MFA, tokens, claims, sessions, and secure account recovery
API integration, distributed-system resilience, caching, logging, latency, and failure handling
Privacy, consent, customer data segregation, auditability, and regulated financial services security expectations
Ability to model complex customer, account, organizational, delegated, and household relationships
Financial services or other regulated industry experience preferred
Preferred certifications: CIAM, CISSP, CSSLP, CCSP, Microsoft identity, or Okta/Auth0; OAuth/OIDC, API security, cloud security, or application security credentials are beneficial
No CTC or sponsorship at this time.