Head of CIAM Platform

As a world leading provider of integrated solutions for the alternative investment industry, Alter Domus (meaning "The Other House" in Latin) is proud to be home to 90% of the top 30 asset managers in the private markets, and more than 6,000 professionals across 24 jurisdictions.

With a deep understanding of what it takes to succeed in alternatives, we believe in being different - in what we do, in how we work and most importantly in how we enable and develop our people. Invest yourself in the alternative, and join an organization where you progress on merit, where you can speak openly with whoever you are speaking to, and where you will be supported along whichever path you choose to take.

Find out more about life at Alter Domus at careers.alterdomus.com

CIAM platform ownership (Auth0)

Platform ownership: Own the Auth0 tenant architecture across environments (dev, test, prod), including applications, APIs, connections, organizations, branding, custom domains, MFA, attack protection and tenant settings.
Configuration as code: Manage all Auth0 configuration through Terraform and GitHub-based pipelines, ensuring every change is versioned, reviewed, tested and reproducible.
Extensibility: Design, build and maintain Auth0 Actions, Forms and custom database / connection scripts in Node.js, with appropriate testing, logging and secret management.
Reliability and operations: Define monitoring, alerting and log streaming (e.g. to Grafana / SIEM), own incident response for identity-related issues and track rate limits, quotas and platform health.
Vendor management: Act as the primary technical contact for Auth0 / Okta, tracking roadmap, licensing, support cases and contract considerations.
Azure AD B2C to Auth0 migration

Migration strategy: Define and own the migration approach from Azure AD B2C, including user migration (bulk import and/or lazy migration), password hash handling, MFA re-enrolment and session continuity.
Policy translation: Analyze existing B2C user flows and custom policies (IEF) and map them to equivalent Auth0 capabilities, identifying gaps and simplification opportunities.
Application cut-over: Plan and coordinate the migration of every relying application, sequencing cut-overs, running parallel operation where required and minimizing user disruption.
Decommissioning: Drive the safe decommissioning of Azure AD B2C once migration is complete, ensuring data retention and compliance obligations are met.
Authorization and OpenFGA

Authorization model: Design and work on our fine-grained authorization model using OpenFGA / Auth0 FGA, applying relationship-based access control (ReBAC) to our multitenant, client- and fund-centric data structures.
Model governance: Maintain authorization models as code, with tests, versioning and a clear change process; guide teams on modeling types, relations and tuples correctly.
Performance and consistency: Ensure authorization checks are performant and consistent at scale, including tuple synchronization patterns, caching strategy and consistency trade-offs.
Integrations and developer enablement

Application integration: Own the patterns by which our applications integrate with the CIAM platform, including OIDC, OAuth 2.0, SAML, PKCE, token validation, refresh tokens and machine-to-machine flows.
Enterprise federation: Onboard client enterprise identity providers (Entra ID, Okta, ADFS, other SAML/OIDC IdPs) via Auth0 Organizations and enterprise connections.
Reusable building blocks: Provide SDK guidance, reference implementations, Terraform modules and documentation so product teams can integrate quickly and securely.
Code review: Review integration code and pull requests across teams to ensure identity is implemented consistently and securely.
Security, governance and compliance

Single point of authority: Be the decision-maker and escalation point for CIAM architecture, standards and exceptions, and represent CIAM in architecture and security forums.
Security posture: Apply identity security best practices, including MFA and passwordless strategies, bot and credential-stuffing protection, token lifetimes, key rotation and least privilege management API access.
Compliance: Ensure the platform supports our regulatory and audit obligations (e.g. GDPR, SOC 1/SOC 2, ISO 27001, DORA), including consent, data residency, auditability and user lifecycle.
Leadership

People leadership: Line-manage, coach and develop one direct report, setting clear objectives and growing their CIAM and engineering expertise.
Roadmap: Own the CIAM roadmap and backlog, balancing migration delivery, new capabilities and technical debt.
Stakeholder engagement: Communicate clearly with engineering, product, security, client service and senior leadership, translating identity topics into business impact.

Required

CIAM expertise: Significant experience (typically 5+ years in engineering, with 3+ years focused on identity) designing and running customer identity platforms in production.
Auth0: Deep, hands-on experience with Auth0 (or Okta Customer Identity), including tenant design, Actions, Organizations, enterprise connections and the Management API.
Azure AD B2C: Solid working knowledge of Azure AD B2C, including user flows and custom policies, and ideally prior experience migrating off it or a comparable platform.
OpenFGA: Strong understanding of OpenFGA / Zanzibar-style authorization, including modeling, relationship tuples, contextual tuples, conditions and operating it at scale.
Identity standards: Expert knowledge of OAuth 2.0, OpenID Connect, SAML 2.0, JWT/JWKS, PKCE, SCIM and modern MFA / passwordless (WebAuthn, passkeys).
Terraform: Strong Terraform skills, including the Auth0 provider, module design, state management and CI/CD-driven plans and applications.
GitHub: Proficiency with GitHub workflows, including branching strategies, pull request reviews, GitHub Actions, environments, secrets and repository governance.
Coding: Strong software engineering skills in Node.js / JavaScript and TypeScript; able to write production-grade, tested code and read code in other languages (e.g. C#/.NET, Python).
Cloud: Experience with AWS and/or Azure, including networking, key management and secret storage relevant to identity services.
Leadership: Experience leading technical initiatives end-to-end and mentoring or managing engineers.
Communication: Excellent written and verbal communication in English, with the confidence to act as the authoritative voice on CIAM.

Nice to have

Certifications: Okta/Auth0 certifications or security certifications (e.g. CISSP).
Workforce identity: Experience with Microsoft Entra ID and the boundary between workforce and customer identity.
Observability: Experience with Grafana, Loki, Prometheus or a SIEM for identity telemetry and threat detection.
Industry: Background in financial services, fund administration or other regulated, multitenant B2B environments.
Platform engineering: Exposure to platform engineering and developer experience practices (golden paths, internal developer portals)

We are committed to supporting your development, advancing your career, and providing benefits that matter to you.


Our industry-leading Alter Domus Academy offers six learning zones for every stage of your career, with resources tailored to your ambitions and resources from LinkedIn Learning.


Our global benefits also include:

Support for professional accreditations such as ACCA and study leave
Flexible arrangements, generous holidays, plus an additional day off for your birthday!
Continuous mentoring along your career progression
Active sports, events and social committees across our offices
24/7 support available from our Employee Assistance Program
The opportunity to invest in our growth and success through our Employee Share Plan
Plus additional local benefits depending on your location
Monthly Salary for this position is from 6000 EUR to 7500 EUR gross. Final offer will be determined based on your competences, qualifications and professional experiences

Alter Domus is an Equal Opportunity Employer: Equity Statement
All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, disability, or protected veteran status.

(Alter Domus Privacy notice can be reviewed via Alter Domus webpage: alterdomus.com/privacy-notice/)

6000-7500 €/mon. gross

Šeimyniškių gatvė 19, Vilnius, Vilnius City Municipality Calculate your travel time to work