Head of CIAM Platform

We are looking for a CIAM Platform Lead to own and evolve our customer identity platform. You will be the single point of authority on everything CIAM: the person engineering teams, security, architecture and product come to for decisions on authentication, authorization, identity federation and the customer login experience. Auth0 is our strategic CIAM platform. You will own its setup and configuration end-to-end, the integrations our applications have with it, and the fine-grained authorization model built on OpenFGA. A major part of the role in the first 12–18 months is leading our transition from Azure AD B2C to Auth0, delivering a secure, low-friction migration for our users and the applications that depend on them. This is a hands-on technical leadership role. You will write code, build infrastructure as code and review pull requests, while also setting standards and shaping the roadmap.

• Own the Auth0 tenant architecture across environments (dev, test, prod), including applications, APIs, connections, organizations, branding, custom domains, MFA, attack protection and tenant settings.
• Manage all Auth0 configuration through Terraform and GitHub-based pipelines, ensuring every change is versioned, reviewed, tested and reproducible.
• Design, build and maintain Auth0 Actions, Forms and custom database / connection scripts in Node.js, with appropriate testing, logging and secret management.
• Define monitoring, alerting and log streaming (e.g. to Grafana / SIEM), own incident response for identity-related issues and track rate limits, quotas and platform health.
• Act as the primary technical contact for Auth0 / Okta, tracking roadmap, licensing, support cases and contract considerations.
• Define and own the migration approach from Azure AD B2C, including user migration (bulk import and/or lazy migration), password hash handling, MFA re-enrolment and session continuity.
• Analyse existing B2C user flows and custom policies (IEF) and map them to equivalent Auth0 capabilities, identifying gaps and simplification opportunities.
• Plan and coordinate the migration of every relying application, sequencing cut-overs, running parallel operation where required and minimising user disruption.
• Drive the safe decommissioning of Azure AD B2C once migration is complete, ensuring data retention and compliance obligations are met.
• Design and work on our fine-grained authorization model using OpenFGA / Auth0 FGA, applying relationship-based access control (ReBAC) to our multitenant, client- and fund-centric data structures.
• Maintain authorization models as code, with tests, versioning and a clear change process; guide teams on modelling types, relations and tuples correctly.
• Ensure authorization checks are performant and consistent at scale, including tuple synchronisation patterns, caching strategy and consistency trade-offs.
• Own the patterns by which our applications integrate with the CIAM platform, including OIDC, OAuth 2.0, SAML, PKCE, token validation, refresh tokens and machine-to-machine flows.
• Onboard client enterprise identity providers (Entra ID, Okta, ADFS, other SAML/OIDC IdPs) via Auth0 Organizations and enterprise connections.
• Provide SDK guidance, reference implementations, Terraform modules and documentation so product teams can integrate quickly and securely.
• Review integration code and pull requests across teams to ensure identity is implemented consistently and securely.
• Be the decision-maker and escalation point for CIAM architecture, standards and exceptions, and represent CIAM in architecture and security forums.
• Apply identity security best practices, including MFA and passwordless strategies, bot and credential-stuffing protection, token lifetimes, key rotation and least-privilege management API access.
• Ensure the platform supports our regulatory and audit obligations (e.g. GDPR, SOC 1/SOC 2, ISO 27001, DORA), including consent, data residency, auditability and user lifecycle.
• Line-manage, coach and develop one direct report, setting clear objectives and growing their CIAM and engineering expertise.
• Own the CIAM roadmap and backlog, balancing migration delivery, new capabilities and technical debt.
• Communicate clearly with engineering, product, security, client service and senior leadership, translating identity topics into business impact.

• Significant experience (typically 5+ years in engineering, with 3+ years focused on identity) designing and running customer identity platforms in production.
• Deep, hands-on experience with Auth0 (or Okta Customer Identity), including tenant design, Actions, Organizations, enterprise connections and the Management API.
• Solid working knowledge of Azure AD B2C, including user flows and custom policies, and ideally prior experience migrating off it or a comparable platform.
• Strong understanding of OpenFGA / Zanzibar-style authorization, including modelling, relationship tuples, contextual tuples, conditions and operating it at scale.
• Expert knowledge of OAuth 2.0, OpenID Connect, SAML 2.0, JWT/JWKS, PKCE, SCIM and modern MFA / passwordless (WebAuthn, passkeys).
• Strong Terraform skills, including the Auth0 provider, module design, state management and CI/CD-driven plans and applies.
• Proficiency with GitHub workflows, including branching strategies, pull request reviews, GitHub Actions, environments, secrets and repository governance.
• Strong software engineering skills in Node.js / JavaScript and TypeScript; able to write production-grade, tested code and read code in other languages (e.g. C#/.NET, Python).
• Experience with AWS and/or Azure, including networking, key management and secret storage relevant to identity services.
• Experience leading technical initiatives end-to-end and mentoring or managing engineers.
• Excellent written and verbal communication in English, with the confidence to act as the authoritative voice on CIAM.

Nice to have

• Okta/Auth0 certifications or security certifications (e.g. CISSP).
• Experience with Microsoft Entra ID and the boundary between workforce and customer identity.
• Experience with Grafana, Loki, Prometheus or a SIEM for identity telemetry and threat detection.
• Background in financial services, fund administration or other regulated, multitenant B2B environments.
• Exposure to platform engineering and developer experience practices (golden paths, internal developer portals)

• Support for professional accreditations such as ACCA and study leave
• Flexible arrangements, generous holidays, plus an additional day off for your birthday!
• Continuous mentoring along your career progression
• Active sports, events and social committees across our offices
• 24/7 support available from our Employee Assistance Program
• The opportunity to invest in our growth and success through our Employee Share Plan
• Plus additional local benefits depending on your location