Lead IAM Engineer

MetLife - New York, NY

Full-time

New York, NY

Insurance Carriers and Related Activities

About the position

The Lead IAM Engineer at MetLife is a pivotal role focused on the implementation and management of modern authentication access management tools. This position involves leading the Authentication Services engineering team responsible for Customer IAM (CIAM) services across both on-premises and cloud environments. The role requires collaboration with cross-functional teams globally to deliver innovative identity solutions and ensure security compliance across various regions.

Responsibilities

• Design and implement scalable IAM solutions that follow a global, hybrid cloud architecture.
• Lead and implement seamless application migration efforts from legacy to modern IDP solutions.
• Work closely with enterprise IAM architects to solution design and publish new CIAM Patterns.
• Conduct proof of concepts for new requirements and feature enhancements.
• Administer and manage authentication services within the CIAM portfolio, implementing proper security controls and policies.
• Provide domain expertise in authentication & access management services and consultancy to global IT teams and business units on new integrations and best practices.
• Implement modern authentication using tools like Ping Federate, Ping Access, and Ping One.
• Partner with app teams to understand their requirements and onboard apps within timelines.
• Provide leadership in level 3 support, troubleshooting, perform RCA and implement mitigation plans.
• Showcase operational excellence and planning in implementing large scale projects.
• Educate and mentor junior team members by conducting demo/training sessions.
• Develop and publish runbooks, architecture documentation, and diagrams for CIAM solutions.
• Conduct regular security audits, identity lifecycle management, and compliance assessments to ensure adherence to global standards such as GDPR and PCI.
• Collaborate with security and compliance teams to maintain and improve the security posture of CIAM systems.
• Proactively identify gaps in technical and admin processes and propose pragmatic solutions.

Requirements

• 6 - 8+ years of strong experience in designing and implementing authentication access management solutions using tools like Ping Federate, Ping Access, and Ping One.
• Proficiency and hands-on knowledge of SAML 2.0, OAuth, OpenID Connect, SSO, Web Access Management, Cloud Security, or API Security.
• Strong knowledge in Ping Federate, Ping Access, Ping One MFA, or PingOne Advanced Services (P1AS).
• 5+ years of strong experience in designing and implementing MFA using factors like Email, SMS, Voice OTP, Mobile App, or FIDO2 Biometrics/Security Keys.
• Led large scale IAM migration projects and experience with CIAM use cases including user self-service registration and password reset flows.
• Experience with Log analytics and SIEM tools such as Splunk, Elastic, or QRadar.

Nice-to-haves

• Bachelor's degree in an engineering discipline (Computer Science, Information Technology, Math or other engineering equivalent).
• Strategic thinking with the ability to lead large-scale IAM initiatives.
• 5+ years of good experience with LDAP directory services (like Ping Directory, AD, ADLDS, CA Directory).
• Solid understanding of cloud security frameworks and zero-trust architecture.
• Ping Identity Certification is a plus.
• Ability to code and write custom scripts is a plus.
• Agile and DevSecOps experience.