Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 73 days ago

Senior Authentication, SSO/MFA & CIAM SME Lead

PepsiCo2,573 open roles

Pay
$110,700 – $170,250 a year
Where
Plano, Texas, United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Authentication, SSO/MFA & CIAM SME LeadPepsiCo · Plano, Texas, United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on PepsiCo's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. PepsiCo postings stay open a median of 1 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 73 days ago

PepsiCo median: 1 days open

The posting

Overview The Authentication, SSO/MFA and CIAM SME/Architect will serve as a senior technical leader within the IAM organization, responsible for defining, architecting, designing, and delivering secure authentication and access management solutions across workforce, partner, and customer identity use cases. This role requires deep hands-on expertise in modern authentication, SSO federation, MFA, passwordless authentication, CIAM, and identity security across hybrid on-premises and cloud environments. The candidate will partner with enterprise architects, cybersecurity, infrastructure, application, and business teams to deliver scalable solutions that improve security, reduce risk, support compliance, and enable business outcomes. This role is based out of Plano, Texas and requires coming into the office. Responsibilities Serve as the senior SME/Architect for Authentication, SSO, MFA, passwordless, federation, and CIAM capabilities across enterprise IAM platforms. Design and solution secure authentication patterns for cloud, SaaS, on-premises, mobile, API, B2B, workforce, and customer-facing applications. Lead technical architecture for SSO integrations using SAML, OAuth 2.0, OIDC, WS-Federation, header-based authentication, reverse proxy, and legacy application patterns. Define MFA and adaptive authentication strategies, including risk-based access, device trust, step-up authentication, passwordless, and phishing-resistant authentication options. Architect CIAM solutions supporting customer registration, login, profile management, consent, progressive profiling, social login, account recovery, and secure API access. Partner with application, cybersecurity, privacy, infrastructure, legal, and business teams to translate business requirements into secure, scalable IAM solutions. Assess current authentication implementations and recommend improvements aligned with security standards, regulatory requirements, zero trust principles, and enterprise architecture guidelines. Provide hands-on technical leadership for complex integrations, troubleshooting, root cause analysis, production support, and platform stability. Develop reusable architecture patterns, reference designs, integration standards, decision records, and implementation playbooks for authentication and CIAM capabilities. Drive platform modernization, automation, and roadmap execution for IAM authentication services, including Okta and related identity platforms. Support governance, risk reduction, audit readiness, and operational controls by ensuring authentication solutions meet security, compliance, logging, monitoring, and access policy requirements. Mentor engineers and delivery teams, provide technical reviews, and enable knowledge transfer across internal and external stakeholders. Champion Agile and DevOps practices, including automation, CI/CD, infrastructure as code, monitoring, and reliable change delivery. Compensation and Benefits: The expected compensation range for this position is between $110,700 - $170,250. Location, confirmed job-related skills, experience, and education will be considered in setting actual starting salary. Your recruiter can share more about the specific salary range during the hiring process. Bonus based on performance and eligibility target payout is 12% of annual salary paid out annually. Paid time off subject to eligibility, including paid parental leave, vacation, sick, and bereavement. In addition to salary, PepsiCo offers a comprehensive benefits package to support our employees and their families, subject to elections and eligibility: Medical, Dental, Vision, Disability, Health, and Dependent Care Reimbursement Accounts, Employee Assistance Program (EAP), Insurance (Accident, Group Legal, Life), Defined Contribution Retirement Plan. Qualifications Minimum Qualifications: 15+ years of overall IT experience, with significant experience in enterprise IAM, cybersecurity, architecture, or application security. 10+ years of hands-on experience architecting, designing, and delivering authentication, SSO, MFA, federation, and access management solutions. 7+ years of hands-on experience with Okta or comparable identity platforms such as Ping, Microsoft Entra ID, ForgeRock, SiteMinder, or similar technologies. Strong working knowledge of SAML, OAuth 2.0, OIDC, JWT, SCIM, LDAP, Kerberos, API security, session management, token lifecycle, and modern authentication flows. Proven experience integrating SaaS, cloud, mobile, API, legacy, and on-premises applications with enterprise SSO and MFA solutions. Hands-on scripting or development experience using PowerShell, Python, Java, JavaScript, Node.js, REST APIs, or similar technologies. Experience with troubleshooting complex authentication issues across browsers, certificates, DNS, network, proxy, load balancers, directories, APIs, and cloud components. Experience working with Agile and DevOps tools, automation practices, release management, and production support processes. Okta Certified Administrator required or strongly preferred; Okta Certified Consultant, Developer, Professional, or equivalent IAM certification preferred. BS/BA degree or equivalent practical experience. Preferred Qualifications: Deep experience with Okta Workforce Identity, Okta Customer Identity, Okta Access Gateway, Okta API Access Management, Lifecycle Management, Workflows, Hooks, and Administrative APIs. Strong CIAM architecture experience, including customer onboarding, registration, authentication journeys, account recovery, consent, privacy, profile management, social identity, and fraud/risk controls. Experience designing authentication solutions for B2B, B2C, partner, contractor, and machine-to-machine use cases. Strong understanding of zero trust, least privilege, conditional access, adaptive MFA, phishing-resistant MFA, FIDO2/WebAuthn, passkeys, and passwordless authentication. Experience with Microsoft Entra ID, PingFederate, SiteMinder, ForgeRock, AWS Cognito, Azure AD B2C, or other identity and federation platforms. Experience with privileged access, service accounts, bot accounts, non-human identities, and secure access patterns for automation and integrations. Experience designing and reviewing authentication controls for applications containing confidential, restricted, regulated, or sensitive data. Strong understanding of directory services such as Active Directory, LDAP, Oracle LDAP, and cloud directory services. Experience with API security, REST integrations, custom connectors, SCIM provisioning, identity orchestration, and workflow automation. Experience with monitoring, logging, and troubleshooting using tools such as Splunk, ELK, Prometheus, or similar platforms. Experience with cloud, container, and DevOps technologies such as Azure, AWS, Docker, Kubernetes, Terraform, Ansible, and CI/CD pipelines. Experience with web infrastructure components such as Apache, middleware, certificates, load balancers, WAF, reverse proxy, and Linux/Windows platforms. Security certifications such as CISSP, CCSP, CIAM, or equivalent identity/security certifications are a plus. Non-Technical skills: Strong communication skills with the ability to explain complex authentication and CIAM concepts to technical teams, business stakeholders, risk partners, and leadership. Ability to influence architecture decisions, challenge assumptions, and drive alignment across application, infrastructure, cybersecurity, privacy, and enterprise architecture teams. Self-starter who can operate with limited direction, own complex technical problems, and drive them to closure. Strong analytical and problem-solving skills with the ability to simplify complex requirements into secure, practical, and scalable solutions. Strong delivery discipline with the ability to balance architecture quality, security requirements, operational stability, and business timelines. Ability to mentor engineers, review technical designs, and raise the overall maturity of the authentication engineering function. Flexible and adaptable, with the ability to manage competing priorities in a fast-paced enterprise environment. EEO Statement Our Company will consider for employment qualified applicants with criminal histories in a manner consistent with the requirements of the Fair Credit Reporting Act, and all other applicable laws, including but not limited to, San Francisco Police Code Sections 4901-4919, commonly referred to as the San Francisco Fair Chance Ordinance; and Chapter XVII, Article 9 of the Los Angeles Municipal Code, commonly referred to as the Fair Chance Initiative for Hiring Ordinance. All qualified applicants will receive consideration for employment without regard to age, race, color, religion, sex, sexual orientation, gender identity, national origin, protected veteran status, or disability status. PepsiCo is an Equal Opportunity Employer: Female / Minority / Disability / Protected Veteran / Sexual Orientation / Gender Identity / Age If you'd like more information about your EEO rights as an applicant under the law, please download the available EEO is the Law & EEO is the Law Supplement documents. View PepsiCo EEO Policy. Please view our Pay Transparency Statement

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against PepsiCo's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on PepsiCo's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    PepsiCo's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.