Location Designation: Hybrid - 3 days per quarter

Technology, Data, AI and Ventures:

The Head of Authentication Engineering, Identity & Access Management is the senior, hands-on technical leader accountable for the strategy, architecture, engineering, and reliability of New York Life's enterprise authentication capabilities across workforce, application, API, cloud (AWS, Azure, and GCP), and emerging AI agent-based access patterns. This is a builder and technical authority role, not a purely advisory or governance position - you will define the target state, make difficult design decisions, and personally engage in the most complex authentication challenges. This is also a people leadership role: you will directly manage a team of authentication engineers, and are accountable for providing them with day to day guidance, technical oversight, and career development.

This leader owns authentication as an end to end capability, including federation, SSO, MFA, passwordless and phishing-resistant authentication, adaptive and continuous authentication, session management, token services, API authorization, and authentication patterns for non human identities and AI enabled systems. User experience is treated as a core engineering outcome, not an afterthought, alongside strong identity assurance. You will need the technical depth to be credible with engineers and architects, and the executive presence to represent Cybersecurity in enterprise governance forums. As the direct manager of the authentication engineering team, you are responsible for staffing, workload allocation, performance management, and ensuring every team member receives the guidance and oversight needed to do their job well.

What You'll Do:
• Own the enterprise authentication strategy, target architecture, roadmap, and standards across workforce, application, API, cloud (AWS, Azure, GCP), and hybrid environments.
• Serve as the authoritative design leader for authentication, federation, authorization, session security, and identity assurance, and position the enterprise for passkeys, workload identity, agent identity, and continuous verification.
• Lead the design and enterprise-scale delivery of phishing-resistant, passwordless authentication (FIDO2, passkeys) and adaptive, risk-based, and continuous authentication models.
• Architect enterprise federation and SSO using SAML 2.0, OAuth 2.0, and OpenID Connect, and design secure API authorization patterns including token exchange, delegation, and fine grained authorization.
• Help set NYL's direction on leading edge authentication and authorization protocols, including Identity Assertion Authorization Grant (ID-JAG), Shared Signals Framework/CAEP, and Transaction Tokens, and evaluate where they fit the enterprise roadmap.
• Treat authentication user experience as a core engineering outcome own end to end journey mapping across devices, platforms, and recovery paths to reduce friction while maintaining strong identity assurance.
• Apply PKI, mTLS, and certificate based authentication for human and machine access, including workload identity across cloud and hybrid platforms.
• Own authentication patterns for non human identities and AI enabled systems, including AI agents, agent to agent interactions, and MCP enabled workflows.
• Use telemetry and testing to identify friction and failure patterns across the authentication journey, and drive continuous, measurable UX improvement.
• Own the reliability and operational health of authentication services, including availability, scalability, latency, and incident response.
• Represent IAM and Cybersecurity in Security Review Board and Architecture Review Board forums, and lead technical reviews of authentication flows, cloud identity, and vendor solutions.
• Serve as the direct people manager for a team of authentication engineers: own hiring, staffing, and workload distribution, conduct regular one on ones and performance reviews, set individual development plans, and provide the hands on technical guidance and day to day oversight needed to raise the team's technical bar.
• Provide adequate guidance and oversight of the team's work at every stage - from design through delivery - including reviewing designs and code, unblocking engineers on complex problems, and ensuring work meets NYL's security, quality, and delivery standards before it ships.

What You'll Bring:
• Bachelor's degree in Computer Science, Information Systems, Engineering, Cybersecurity, or equivalent practical experience.
• 12+ years of progressive experience in identity and access management, security engineering, or platform engineering, including significant leadership of enterprise authentication engineering.
• 5+ years of experience as a direct people manager of engineers, with a demonstrated track record of hiring, coaching, performance management, and career development, and the ability to provide the guidance and oversight a technical team needs day to day.
• Expert level knowledge of SAML 2.0, OAuth 2.0, OpenID Connect, federation, SSO, MFA, session security, and token lifecycle management.
• Deep hands on experience with enterprise federation and access management platforms such as PingFederate, PingAccess, PingOne, or comparable technologies.
• Demonstrated ability to design authentication journeys that are secure, low friction, and measurable, with a track record of using UX and telemetry data to drive improvement.
• Proven experience delivering passwordless and phishing resistant authentication at enterprise scale (FIDO2, passkeys, Windows Hello for Business, HYPR, or equivalent).
• Strong experience with API security and authorization, including gateways, token exchange, delegation, and fine grained authorization.
• Practical experience with PKI, mTLS, certificate based authentication, and machine or workload authentication across cloud platforms (AWS, Azure, or GCP).
• Ability to lead technical reviews, make high consequence design decisions, and communicate clearly with engineers, executives, governance bodies, and risk partners.

Preferred Qualifications:
• Experience modernizing authentication in a regulated financial services or similarly complex enterprise environment.
• Experience integrating authentication with zero trust network access, cloud platforms (AWS, Azure, GCP), and enterprise device management.
• Experience securing non human identities, AI agents, agent to agent interactions, delegated access, or MCP enabled systems.
• Experience with workload identity standards such as SPIFFE/SPIRE and cloud native service identity.
• Experience with policy as code and fine grained authorization approaches such as OPA, Cedar, ABAC, or relationship based access control.
• Familiarity with leading edge and emerging web access management (WAM) protocols such as ID-JAG, Shared Signals Framework/CAEP, and Transaction Tokens, and the judgment to help set enterprise direction on their adoption.
• Relevant certifications such as CISSP, CISM, CCSP, or a cloud security credential (AWS, Azure, or GCP).

Job Level: LEVELPF5

Pay Transparency

Salary Range: $147,500-$211,000

Overtime eligible: Exempt

Discretionary bonus eligible: Yes

Sales bonus eligible: No

Actual base salary will be determined based on several factors but not limited to individual's experience, skills, qualifications, and job location. Additionally, employees are eligible for an annual discretionary bonus. In addition to base salary, employees may also be eligible to participate in an incentive program.

Our Benefits

We provide a full package of benefits for employees - and have unique offerings for a modern workforce, including leave programs, adoption assistance, and student loan repayment programs. Based on feedback from our employees, we continue to refine and add benefits to our offering, so that you can flourish both inside and outside of work.Click hereto discover more about our comprehensive benefit options or visit our NYL Benefits Site.

Job Requisition ID: 94834