Head of CIAM Platform (Alter Domus Lithuania, UAB)

Job description:
We are looking for a CIAM Platform Lead to own and evolve our customer identity platform. You will be the single point of authority on everything CIAM: the person engineering teams, security, architecture and product come to for decisions on authentication, authorization, identity federation and the customer login experience. Auth0 is our strategic CIAM platform. You will own its setup and configuration end-to-end, the integrations our applications have with it, and the fine-grained authorization model built on OpenFGA. A major part of the role in the first 12–18 months is leading our transition from Azure AD B2C to Auth0, delivering a secure, low-friction migration for our users and the applications that depend on them. This is a hands-on technical leadership role. You will write code, build infrastructure as code and review pull requests, while also setting standards and shaping the roadmap.
Own the Auth0 tenant architecture across environments (dev, test, prod), including applications, APIs, connections, organizations, branding, custom domains, MFA, attack protection and tenant settings.
Manage all Auth0 configuration through Terraform and GitHub-based pipelines, ensuring every change is versioned, reviewed, tested and reproducible.
Design, build and maintain Auth0 Actions, Forms and custom database / connection scripts in Node.js, with appropriate testing, logging and secret management.
Define monitoring, alerting and log streaming (e.g. to Grafana / SIEM), own incident response for identity-related issues and track rate limits, quotas and platform health.
Act as the primary technical contact for Auth0 / Okta, tracking roadmap, licensing, support cases and contract considerations.
Define and own the migration approach from Azure AD B2C, including user migration (bulk import and/or lazy migration), password hash handling, MFA re-enrolment and session continuity.
Analyse existing B2C user flows and custom policies (IEF) and map them to equivalent Auth0 capabilities, identifying gaps and simplification opportunities.
Plan and coordinate the migration of every relying application, sequencing cut-overs, running parallel operation where required and minimising user disruption.
Drive the safe decommissioning of Azure AD B2C once migration is complete, ensuring data retention and compliance obligations are met.
Design and work on our fine-grained authorization model using OpenFGA / Auth0 FGA, applying relationship-based access control (ReBAC) to our multitenant, client- and fund-centric data structures.
Maintain authorization models as code, with tests, versioning and a clear change process; guide teams on modelling types, relations and tuples correctly.
Ensure authorization checks are performant and consistent at scale, including tuple synchronisation patterns, caching strategy and consistency trade-offs.
Own the patterns by which our applications integrate with the CIAM platform, including OIDC, OAuth 2.0, SAML, PKCE, token…