Customer Identity & Access Management (CIAM) Security Architecture Lead

IDEXX’s Cyber Security and Information Security teams enable a resilient, adaptable, and security-aware enterprise—supporting the technology that delivers trusted products and solutions to customers worldwide.

The Customer Identity & Access Management (CIAM) Security Architecture Lead is a senior, high-impact role within the Information Security organization, serving as the primary architectural authority and technical visionary for customer identity across IDEXX’s customer-facing ecosystem.

This roleis responsible forassessing, strengthening, and evolving a secure, scalable, and unified CIAM architecture that supports multiple products, customer types, and integration models—while delivering a consistent, friction-aware customer experience. IDEXX has an existing Auth0 implementation in place; however, this role will lead a comprehensive review and re-architecture of the current environment to ensure it is securely implemented, properly configured, and aligned to enterprise-scale requirements and long-term CIAM vision.

While Auth0 is the current CIAM platform, this rolemaintainsa platform-agnostic security architecture perspective, ensuring IDEXX can evolve, extend, or transition CIAM platforms as business, risk, or regulatory needschange. You will bridge executive strategy and hands-on engineering execution—defining not only what is built, but how customer identity integrates into IDEXX’s broader cyber security architecture, ensuring identity is a business enabler, not a constraint.

Location: We are seeking someone driving distance to our Westbrook, Maine HQ where you will be able to work hybrid, with a minimum of 8 days on-site per month. We are also open to those willing to relocate.

In this role, your key responsibilities will include...

CIAM Security Architecture & Platform Leadership:

• Serve as the security architecture authority for customer identity and access management across all customer-facing products

• Assess the existing Auth0 deployment and lead remediation, reconfiguration, and architectural improvements to meet enterprise security and scale requirements

• Design and evolve an enterprise CIAM architecture thatremainsportable across other CIAM platforms (e.g., Okta CIAM, Ping Identity, ForgeRock, Microsoft Entra ID)

• Establish CIAM security standards, reference architectures, control requirements, and guardrails aligned with Zero Trust principles and enterprise security strategy

​

Strategic Roadmap & Vision

• Develop andmaintaina multi-year CIAM roadmap aligned with enterprise goals and digital transformation initiatives

• Define future-state capabilities including SSO, MFA,passwordlessauthentication, adaptive authentication, modern RBAC/ABAC models, and expansion across B2B and B2C use cases

• Ensure the roadmap addresses remediation of current-state gaps while enabling long-term scalability and consistency

​

Authentication, Authorization & Federation

• Architect and govern secure authentication and authorization patterns across diverse customer use cases

• Design and implement federated identity integrations using OIDC, OAuth 2.0, and SAML

• Support customer-managed and federated identity scenarios, including trust boundary definition, assurance levels, and delegated administration models

​

Multi-Tenant, Admin & Delegated Access Models

• Architect secure multi-tenant CIAM models supporting multiple products, customers, and environments

• Design layered administrative and delegated access controls for internal operations and customer administrators

• Ensure administrative access adheres to least privilege, separation of duties, and strong auditability

​

Integrations, System Accounts & Non-Human Identity

• Architect CIAM solutions supporting both human customer identities and system, service, and integration accounts

• Define secure API authentication, token lifecycle management,system to system (internal and external) authentication patternsand non-interactive access patterns

​

Security Controls, Risk & Governance

• Define andvalidatesecurity controls, configurations, and assurance requirements for CIAM implementations

• Ensure CIAM solutions integrate with the broader security ecosystem including SIEM/SOAR, IAM/IGA, monitoring, and fraud detection platforms

• Partner with GRC, Security Operations, and Product Security teams to perform threat modeling, support audits, and reduce identity-related risk

​

Cross-Functional Leadership & Communication

• Act as the primary CIAM security advisor to Product, Marketing, IT, Engineering, and Platform teams

• Translate complex identity and security requirements into clear, consumable architectural guidance

• Communicate CIAM strategy, risk posture, and progress to VP-level and executive leadership

​

What You Will NeedToSucceed...

• 8+ years of experience in CIAM/IAM with at least 3 years in a lead or security architecture capacity

• Demonstrated experience assessing, remediating, and scaling existing CIAM implementations in complex environments

• Deep hands-on experience with Auth0 and at least oneadditionalTier-1 CIAM platform (e.g., Okta CIAM, Ping Identity, ForgeRock, Microsoft Entra ID)

• Expertisein OIDC, OAuth 2.0, SAML, FIDO2/WebAuthn, and SCIM

• Strong understanding of modern application architectures (SPAs, microservices, mobile APIs) and cloud platforms (AWS preferred)

• Proven ability to translate identity risk and architectural gaps into actionable remediation and roadmap decisions

• Strong understanding of Zero Trust principles, identity threat models, logging, monitoring, and auditability

• Ability to communicate complex security concepts to technical and non-technical stakeholders

• Proven ability to navigate a matrixed organization toaccomplishgoals

Preferred Qualifications

• Security certifications such as CISSP-ISSAP, CISM, or senior vendor certifications (e.g., Okta or Auth0 Certified Architect)

• Experience with Identity-as-Code, CI/CD pipelines, and Terraform