Senior Software Engineer - CIAM

The Senior Customer Identity & Access Management (CIAM) Software Engineer is responsible at the advanced level for designing, building, and supporting customer identity, authentication, and access solutions across retail, business, commercial, wealth, and institutional digital experiences. Working independently within the Software Development Life Cycle (SDLC), this role writes and delivers secure, resilient code, contributes to the team's technical requirements gathering, and helps ensure customer access is secure, seamless, and compliant.

The individual works closely with lead and principal engineers, product owners, cybersecurity, fraud, architecture, and application teams to deliver authentication experiences, customer identity verification capabilities, MFA and step-up flows, password recovery services, customer profile management, and authorization integrations.

Primary Responsibilities

• Work independently within the boundaries of the approved Software Development Life Cycle (SDLC) to design, develop, test, and deploy CIAM applications and integrations that solve business needs and minimize risk to the Bank through clean, secure, and resilient code.
• Author organized, clean, efficient, and secure source code at an advanced level, primarily in C#/.NET and JavaScript, with work verified by a lead software engineer, applying appropriate data structures, algorithms, and design patterns to solve business problems.
• Build and enhance customer authentication and authorization capabilities, including login, MFA and step-up flows, password recovery, customer profile management, and SSO integrations, using OAuth 2.0, OpenID Connect (OIDC), SAML, and JWT/token-based security models.
• Develop and maintain Web APIs and services that integrate customer identity platforms with digital banking channels and partner applications.
• Regularly review pull requests, provide constructive feedback on code quality and improvements, and execute on the change management of approved requests.
• Utilize source code management tools to manage and deploy code and applications, ensure compliance with SDLC policies, and support merge conflict resolution.
• Write and maintain automated unit and integration tests and contribute to CI/CD pipelines, code-quality analysis, and security scanning to ensure applications are production ready.
• Independently analyze and critique technical and business requirements to ensure completeness, accuracy, and feasibility, and provide estimates for development work.
• Support production operations for CIAM applications, including incident triage, troubleshooting, and root cause analysis, using application monitoring and observability tools.
• Collaborate, document, and communicate technical implementation details clearly and concisely with other teams on dependent requirements as needed.
• Contribute to conversations with lead engineers, architects, and business or technical stakeholders regarding application architecture and design, raising risks and recommending improvements.
• Share knowledge with peers and less experienced engineers through code reviews, pairing, and documentation.
• Understand and adhere to the Company's risk and regulatory standards, policies, and controls in accordance with the Company's Risk Appetite. Identify risk-related issues needing escalation to management.
• Promote an environment that supports a culture of belonging and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators, as applicable.
• Complete other related duties as assigned.

Scope of Responsibilities

Supervisory/Managerial Responsibilities

• No supervisory responsibilities.
• Provides informal knowledge sharing and peer support to team members through code reviews and collaboration.

Education and Experience Required

• Associate's degree and a minimum of 5 years' systems analysis and/or application development work experience or Bachelor's degree and a minimum of 3 years' systems analysis and/or application development work experience. In lieu of a degree, a combined minimum of 7 years' education and/or relevant work experience, including a minimum of 3 years' systems analysis and/or application development work experience.
• Advanced proficiency in a minimum of 1 relevant programming language, preferably C#/.NET.
• Hands-on experience with JavaScript for web or API development.
• Working knowledge of software design patterns, Web APIs, microservices, and distributed systems concepts.
• Experience implementing or supporting authentication and authorization using OAuth 2.0, OpenID Connect (OIDC), SAML, JWT/token-based security, and SSO.
• Hands-on experience with source control platforms (such as Git), CI/CD pipelines, and automated build and deployment processes.
• Experience working in Agile delivery teams using collaboration and work-tracking tools.

Education and Experience Preferred

• Advanced analytical skills specific to application development.
• Ability to work autonomously and multitask on complex projects.
• Strong organizational and time-management skills.
• Proficient verbal and written communication skills.
• Experience with Angular or another modern front-end framework.
• Experience with customer identity (CIAM) platforms such as Strivacity, PingFederate, or similar identity providers.
• Familiarity with MFA, step-up and adaptive/risk-based authentication, passkeys, and fraud-aware authentication patterns.
• Experience with Microsoft Azure and cloud-native technologies, such as Azure App Service, Azure Kubernetes Service (AKS), Azure Functions, managed identities, and Entra ID.
• Experience with DevSecOps and observability tools such as Dynatrace, Kibana, SonarQube, Aqua, and Mend.
• Experience developing software in financial services or another regulated industry.

Location