Identity is now the control plane attackers target first, yet most IAM engineers were trained for human logins and are being handed service accounts, workload identities and AI agents with no change in skills or job description. This guide covers what an identity and access management (IAM) engineer builds and runs, the protocols and tools the job depends on, routes in from infrastructure, development and security operations, the certifications that fit, and how the role progresses into architecture, privileged access and non-human identity (NHI) specialism. It is written for engineers entering identity, IAM administrators moving to engineering, and managers hiring for identity teams. The wider map of security roles is in the Cybersecurity Careers Guide.
Key takeaways
- Protocols are the core skill. SAML 2.0, OpenID Connect, OAuth 2.0 and SCIM 2.0 underpin every identity platform; engineers who can read a token or an assertion debug in minutes what others escalate for days.
- Human identity is half the job. Service accounts, API keys, workload identities and AI agents now outnumber people in most estates and need the same lifecycle, ownership and least privilege.
- Automate the lifecycle. Joiner, mover and leaver automation from an authoritative source, with SCIM provisioning and access reviews, is where an IAM engineer removes the most risk.
- Certify for the platform, study for the domain. A vendor certification such as Microsoft SC-300 proves platform skill; IDPro's vendor-neutral CIDPRO and Body of Knowledge cover the discipline.
- NHI and agent identity is the growth path. Workload identity federation, SPIFFE, secrets management and delegated authorisation for AI agents are skills few engineers have yet.
What the role does
An IAM engineer designs, builds and operates the systems that decide who and what can authenticate and what they may do. Titles vary (identity engineer, IAM engineer, IAM developer, identity platform engineer), and the work spans five areas.
| Area | Typical tasks | Systems involved |
|---|---|---|
| Access management | Onboard applications to single sign-on, configure MFA and phishing-resistant authentication, write Conditional Access or sign-on policies | Identity provider (IdP), SAML and OIDC apps, FIDO2 authenticators |
| Lifecycle and governance | Build joiner, mover, leaver flows from HR, SCIM provisioning, role models, access review campaigns | HR system, IGA platform, SCIM 2.0 connectors |
| Directory and infrastructure | Run Active Directory and cloud directories, LDAP (389, or 636 for LDAPS) and Kerberos (88), hybrid sync, certificate services | AD, Entra ID or equivalent, PKI |
| Privileged access | Vault admin credentials, just-in-time elevation, session recording, break-glass accounts | PAM, PIM, cloud IAM |
| Non-human and agent identity | Inventory service accounts and keys, move workloads to federation, rotate secrets, scope OAuth clients and AI agent permissions | Secrets managers, workload identity, OAuth authorisation servers, MCP servers |
In a small organisation one engineer covers all five. In a large one the team splits into access management, IGA, PAM and increasingly a workload or NHI identity function. See IAM and IGA Basics for the underlying concepts.
A worked example: onboarding an application
- Agree requirements: protocol (OIDC preferred for new apps, SAML for legacy), required claims, MFA level, and who owns the app.
- Configure in a test tenant: register the client, restrict redirect URIs, set token lifetimes, map groups to roles.
- Provision: enable SCIM 2.0 so accounts are created and, more importantly, disabled automatically. See the SCIM Provisioning Guide.
- Pilot: a small group first; keep local login for one break-glass account only.
- Cut over and disable local accounts: remove the old password path so SSO cannot be bypassed.
- Roll back plan: a documented switch back to the previous login method, tested before go-live.
Core skills and tools
| Skill | What good looks like | Read next |
|---|---|---|
| Federation protocols | Decodes a SAML assertion and a JWT, explains audience, issuer, signature and expiry checks, knows the OAuth 2.0 grant types and why implicit is avoided | OAuth 2.0 and OpenID Connect Guide, SAML Security Guide |
| Authentication assurance | Applies NIST SP 800-63-4 (63A proofing, 63B authenticators, 63C federation) and deploys phishing-resistant MFA | Conditional Access Guide |
| Authorisation | Designs RBAC, ABAC or relationship-based models, and knows when policy as code fits | Authorisation Models Guide |
| Directories | Hardens AD and cloud directories, understands Kerberos delegation and tiering | Active Directory and Entra ID Hardening Guide |
| Cloud IAM | Writes least-privilege AWS, Azure and Google Cloud policies, reads trust policies and role assumptions | AWS IAM Policies and Roles Guide |
| Automation | Scripts in PowerShell or Python against IdP and Graph-style APIs; manages identity configuration as code with review and rollback | Identity Security Programme Guide |
| Detection | Reads sign-in and audit logs, spots token theft (ATT&CK T1528) and valid cloud account abuse (T1078.004) | ITDR Guide |
Non-human and AI agent identity skills
This is the fastest-growing part of the role and the one where NHI Mgmt Group sees the largest skills gap. The OWASP Non-Human Identities Top 10 (2025) is a practical syllabus: NHI1 Improper Offboarding, NHI2 Secret Leakage, NHI5 Overprivileged NHI, NHI7 Long-Lived Secrets and NHI10 Human Use of NHI describe problems an IAM engineer is expected to fix.
- Inventory and ownership: find every service account, API key, OAuth client and certificate, and assign a human owner. See the Service Account Security Guide and NHI Ownership Guide.
- Replace secrets with federation: use workload identity federation and short-lived credentials. SPIFFE defines open standards for identifying software, issuing short-lived SVIDs as X.509 certificates or JWTs, with SPIRE as an implementation. See the Workload Identity Federation Guide.
- Manage what remains: vault and rotate secrets, scan for leaks. See the Secrets Management Guide.
- Agent identity: give each AI agent its own identity, delegate user authority with OAuth token exchange rather than shared keys, and scope tool access, including MCP servers. See the Agentic AI Identity Guide and AI Agent Authorisation Guide.
The Microsoft Midnight Blizzard breach, where a legacy test OAuth application was abused to reach corporate mailboxes, is a good case study of why NHI lifecycle belongs in an IAM engineer's remit.
Routes into the role
| Background | What transfers | What to add |
|---|---|---|
| Service desk or IAM administration | Account and group operations, password resets, ticket discipline | Protocols, scripting, design thinking |
| Windows or Linux systems administration | AD, Kerberos, LDAP, group policy | Cloud IdPs, OIDC and OAuth, SCIM |
| Software development | APIs, tokens, code review, CI/CD | Directory concepts, governance and audit expectations |
| Cloud or platform engineering | Cloud IAM, infrastructure as code, workloads | Workforce identity, lifecycle, access reviews |
| SOC analyst | Sign-in log analysis, attacker techniques | Building and changing identity systems safely |
The US Bureau of Labor Statistics does not publish a separate IAM occupation. Much IAM work falls in information security analysts, for which it reports a median wage of $129,180 in May 2025 and projected growth of 21% from 2025 to 2035; treat this only as broad context.
A home lab path
- Stand up an IdP: a free developer tenant from a commercial IdP or an open-source IdP such as Keycloak.
- Federate two apps: one with SAML, one with OIDC; capture and decode the assertion and tokens.
- Automate lifecycle: a CSV "HR feed" that creates, moves and disables users through SCIM or the IdP API.
- Add an NHI: a workload that calls an API using client credentials, then replace its static secret with a federated or short-lived credential.
- Add an agent: give a small AI agent its own client with narrowly scoped access and log every call.
- Write it up: design decisions, what broke, and how you would roll back.
Certifications that help
Facts from the issuing bodies' own pages, checked 24 October 2026. Not a ranking.
| Certification | Body | Official scope | Best fit |
|---|---|---|---|
| CIDPRO | IDPro | Vendor-neutral identity; about 150 multiple-choice questions in three hours, no listed prerequisites, no continuing education requirement at present; exam fee $750 with member discounts | Proving domain knowledge across platforms |
| Identity and Access Administrator Associate (SC-300) | Microsoft | User identities; authentication and access management; workload identities; identity governance; free annual renewal assessment | Microsoft Entra estates. See the Microsoft Security Certifications Guide |
| Cloud provider security certifications | AWS, Microsoft, Google | Cloud IAM within broader cloud security | Cloud-heavy identity work. See the AWS Certified Security Specialty Guide |
| IdP vendor certifications | Identity platform vendors | Product configuration and administration | Teams standardised on that platform |
| CISSP | ISC2 | Broad security, including an identity and access management domain | Senior and architect roles. See the CISSP Certification Guide |
Microsoft notes the English SC-300 exam is being updated on 28 October 2026, so check the study guide before preparing. IDPro also publishes the Body of Knowledge, "a growing compilation of IAM knowledge" that is vendor-neutral and community reviewed, which is the recommended CIDPRO study source and a useful reference throughout a career. For NHI specifically, NHI Mgmt Group runs an NHI Foundation Level training course. A wider comparison is in the Identity Certifications Guide.
Decision guidance: early on, take the certification for the platform your employer runs; once you work across platforms or consult, add CIDPRO; for architecture roles, CISSP. In a small organisation breadth matters more than any badge; large organisations often require the vendor certification for the platform team.
Progression
| Path | What changes | Build now |
|---|---|---|
| Senior IAM engineer, then identity architect | Owns reference architecture, standards and roadmap | Design documents, federation and trust design. See the Federation and Trust Relationships Guide |
| Privileged access specialist | Runs PAM and just-in-time access | Tiering, vaulting, session controls. See the Privileged Access Management Guide |
| Identity governance lead | Owns roles, certifications and segregation of duties | IGA, audit liaison. See the Identity Governance Maturity Model |
| NHI and workload identity specialist | Owns machine and agent identity programme | Federation, secrets, OAuth delegation. See the NHI Governance Maturity Model |
| Customer identity (CIAM) | Builds sign-up, login and consent at consumer scale | Passkeys, fraud signals. See the Customer IAM (CIAM) Guide |
| Identity threat detection | Detects and responds to identity attacks | Log analysis, ITDR |
| Head of identity | Programme, budget, board reporting | Metrics, stakeholder management |
Framework mapping
| Framework | Where IAM engineering sits |
|---|---|
| NIST CSF 2.0 | PR.AA Identity Management, Authentication, and Access Control |
| NIST SP 800-53 Rev. 5 | AC-2 Account Management, AC-6 Least Privilege, IA-2 Identification and Authentication (Organizational Users), IA-5 Authenticator Management, IA-9 Service Identification and Authentication |
| NIST SP 800-63-4 | Identity proofing (63A), authentication (63B) and federation (63C) |
| OWASP NHI Top 10 (2025) | NHI1 to NHI10, the risk list for non-human identities |
| MITRE ATT&CK | T1078 Valid Accounts, T1078.004 Cloud Accounts, T1528 Steal Application Access Token |
Measuring your impact
- SSO coverage: share of applications behind the IdP with local login disabled.
- Leaver latency: time from HR termination to every account disabled.
- Phishing-resistant MFA: share of users, and all admins, on FIDO2 or passkeys.
- NHI ownership and age: share of service accounts and keys with a named owner, and count of secrets older than policy.
- Standing privilege: number of permanent admin assignments versus just-in-time.
Common failure patterns
- Click-ops without change control: policy edits in the console with no review or rollback lock out users or open bypasses.
- SSO with the back door open: local passwords left enabled after federation.
- Ignoring machine identities: stale tokens and keys outlive projects; the Okta breach involved a service account whose credentials were exposed.
- Weak help desk recovery: MFA resets by phone without verification enabled the MGM Resorts breach.
- Shared keys for AI agents: agents running on a developer's personal token with full scope, so every action looks like the human.
Practitioner checklist
- Decode a SAML assertion and an OIDC ID token by hand and explain every field you rely on.
- Build a lab with one SAML app, one OIDC app and SCIM provisioning, with a tested rollback.
- Learn NIST SP 800-63-4 assurance concepts and deploy phishing-resistant MFA for admins first.
- Script one lifecycle task against your IdP's API and keep identity configuration in version control.
- Inventory service accounts, API keys and OAuth clients and assign owners.
- Replace one static secret with workload identity federation or a short-lived credential.
- Give any AI agent its own identity with narrowly scoped, logged access.
- Take the platform certification your employer uses, then a vendor-neutral one such as CIDPRO.
- Track leaver latency, SSO coverage and NHI ownership as your own measures.
Standards and references
- NIST: SP 800-63-4 Digital Identity Guidelines
- NIST: Cybersecurity Framework 2.0
- OWASP: Non-Human Identities Top 10 2025
- SPIFFE: Overview
- IDPro: Body of Knowledge
- IDPro: CIDPRO Certification
- Microsoft Learn: Identity and Access Administrator Associate (SC-300)
- US Bureau of Labor Statistics: Information Security Analysts, Occupational Outlook Handbook
Related NHI Mgmt Group resources: Cybersecurity Careers Guide · Identity Certifications Guide · Human vs Non-Human Identity · NHI Authentication Guide · Zero Trust Identity Guide