Head of CIAM Platform

ABOUT US:

As a world leading provider of integrated solutions for the alternative investment industry, Alter Domus (meaning “The Other House” in Latin) is proud to be home to 90% of the top 30 asset managers in the private markets, and more than 6,000 professionals across 24 jurisdictions.

With a deep understanding of what it takes to succeed in alternatives, we believe in being different - in what we do, in how we work and most importantly in how we enable and develop our people. Invest yourself in the alternative, and join an organization where you progress on merit, where you can speak openly with whoever you are speaking to, and where you will be supported along whichever path you choose to take.

Find out more about life at Alter Domus at careers.alterdomus.com

About the role

We are looking for a CIAM Platform Lead to own and evolve our customer identity platform. You will

be the single point of authority on everything CIAM: the person engineering teams, security,

architecture and product come to for decisions on authentication, authorization, identity federation

and the customer login experience.

Auth0 is our strategic CIAM platform. You will own its setup and configuration end-to-end, the

integrations our applications have with it, and the fine-grained authorization model built on

OpenFGA. A major part of the role in the first 12–18 months is leading our transition from Azure AD

B2C to Auth0, delivering a secure, low-friction migration for our users and the applications that

depend on them.

This is a hands-on technical leadership role. You will write code, build infrastructure as code and

review pull requests, while also setting standards and shaping the roadmap.

Key responsibilities

CIAM platform ownership (Auth0)

• Platform ownership: Own the Auth0 tenant architecture across environments (dev, test,

prod), including applications, APIs, connections, organizations, branding, custom domains,

MFA, attack protection and tenant settings.

• Configuration as code: Manage all Auth0 configuration through Terraform and GitHub-based

pipelines, ensuring every change is versioned, reviewed, tested and reproducible.

• Extensibility: Design, build and maintain Auth0 Actions, Forms and custom database /

connection scripts in Node.js, with appropriate testing, logging and secret management.

• Reliability and operations: Define monitoring, alerting and log streaming (e.g. to Grafana /

SIEM), own incident response for identity-related issues and track rate limits, quotas and

platform health.

• Vendor management: Act as the primary technical contact for Auth0 / Okta, tracking

roadmap, licensing, support cases and contract considerations.

Azure AD B2C to Auth0 migration

• Migration strategy: Define and own the migration approach from Azure AD B2C, including

user migration (bulk import and/or lazy migration), password hash handling, MFA re-enrolment

and session continuity.

• Policy translation: Analyse existing B2C user flows and custom policies (IEF) and map them

to equivalent Auth0 capabilities, identifying gaps and simplification opportunities.

• Application cut-over: Plan and coordinate the migration of every relying application,

sequencing cut-overs, running parallel operation where required and minimising user

disruption.

• Decommissioning: Drive the safe decommissioning of Azure AD B2C once migration is

complete, ensuring data retention and compliance obligations are met.

Authorization and OpenFGA

• Authorization model: Design and work on our fine-grained authorization model using

OpenFGA / Auth0 FGA, applying relationship-based access control (ReBAC) to our multitenant, client- and fund-centric data structures.

• Model governance: Maintain authorization models as code, with tests, versioning and a clear

change process; guide teams on modelling types, relations and tuples correctly.

• Performance and consistency: Ensure authorization checks are performant and consistent

at scale, including tuple synchronisation patterns, caching strategy and consistency trade-offs.

Integrations and developer enablement

• Application integration: Own the patterns by which our applications integrate with the CIAM

platform, including OIDC, OAuth 2.0, SAML, PKCE, token validation, refresh tokens and

machine-to-machine flows.

• Enterprise federation: Onboard client enterprise identity providers (Entra ID, Okta, ADFS,

other SAML/OIDC IdPs) via Auth0 Organizations and enterprise connections.

• Reusable building blocks: Provide SDK guidance, reference implementations, Terraform

modules and documentation so product teams can integrate quickly and securely.

• Code review: Review integration code and pull requests across teams to ensure identity is

implemented consistently and securely.

Security, governance and compliance

• Single point of authority: Be the decision-maker and escalation point for CIAM architecture,

standards and exceptions, and represent CIAM in architecture and security forums.

• Security posture: Apply identity security best practices, including MFA and passwordless

strategies, bot and credential-stuffing protection, token lifetimes, key rotation and leastprivilege management API access.

• Compliance: Ensure the platform supports our regulatory and audit obligations (e.g. GDPR,

SOC 1/SOC 2, ISO 27001, DORA), including consent, data residency, auditability and user

lifecycle.

Leadership

• People leadership: Line-manage, coach and develop one direct report, setting clear

objectives and growing their CIAM and engineering expertise.

• Roadmap: Own the CIAM roadmap and backlog, balancing migration delivery, new

capabilities and technical debt.

• Stakeholder engagement: Communicate clearly with engineering, product, security, client

service and senior leadership, translating identity topics into business impact.

What you'll bring

Required

• CIAM expertise: Significant experience (typically 5+ years in engineering, with 3+ years

focused on identity) designing and running customer identity platforms in production.

• Auth0: Deep, hands-on experience with Auth0 (or Okta Customer Identity), including tenant

design, Actions, Organizations, enterprise connections and the Management API.

• Azure AD B2C: Solid working knowledge of Azure AD B2C, including user flows and custom

policies, and ideally prior experience migrating off it or a comparable platform.

• OpenFGA: Strong understanding of OpenFGA / Zanzibar-style authorization, including

modelling, relationship tuples, contextual tuples, conditions and operating it at scale.

• Identity standards: Expert knowledge of OAuth 2.0, OpenID Connect, SAML 2.0,

JWT/JWKS, PKCE, SCIM and modern MFA / passwordless (WebAuthn, passkeys).

• Terraform: Strong Terraform skills, including the Auth0 provider, module design, state

management and CI/CD-driven plans and applies.

• GitHub: Proficiency with GitHub workflows, including branching strategies, pull request

reviews, GitHub Actions, environments, secrets and repository governance.

• Coding: Strong software engineering skills in Node.js / JavaScript and TypeScript; able to

write production-grade, tested code and read code in other languages (e.g. C#/.NET, Python).

• Cloud: Experience with AWS and/or Azure, including networking, key management and

secret storage relevant to identity services.

• Leadership: Experience leading technical initiatives end-to-end and mentoring or managing

engineers.

• Communication: Excellent written and verbal communication in English, with the confidence

to act as the authoritative voice on CIAM.

Nice to have

• Certifications: Okta/Auth0 certifications or security certifications (e.g. CISSP).

• Workforce identity: Experience with Microsoft Entra ID and the boundary between workforce

and customer identity.

• Observability: Experience with Grafana, Loki, Prometheus or a SIEM for identity telemetry

and threat detection.

• Industry: Background in financial services, fund administration or other regulated, multitenant B2B environments.

• Platform engineering: Exposure to platform engineering and developer experience practices

(golden paths, internal developer portals)

WHAT WE OFFER

We are committed to supporting your development, advancing your career, and providing benefits that matter to you.

Our industry-leading Alter Domus Academy offers six learning zones for every stage of your career, with resources tailored to your ambitions and resources from LinkedIn Learning.

Our global benefits also include:

Support for professional accreditations such as ACCA and study leave

Flexible arrangements, generous holidays, plus an additional day off for your birthday!

Continuous mentoring along your career progression

Active sports, events and social committees across our offices

24/7 support available from our Employee Assistance Program

The opportunity to invest in our growth and success through our Employee Share Plan

Plus additional local benefits depending on your location

Monthly Salary for this position is from 5500 EUR to 6000 EUR gross. Final offer will be determined based on your competences, qualifications and professional experiences.

Alter Domus is an Equal Opportunity Employer: Equity Statement

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, or protected veteran status.

(Alter Domus Privacy notice can be reviewed via Alter Domus webpage: https://alterdomus.com/privacy-notice/)

#LI-HYBRID

#LI-PM1