IAM Engineer

IAM Engineers design and operate identity systems: SSO, MFA, lifecycle management, privileged access, customer identity (CIAM). The role is increasingly senior in zero-trust transformations and is the de-facto first hire in identity-led security programmes. ## Career milestones ### Year 0 — IAM Analyst / IdAM Administrator _Salary: £40k–£55k_ Onboard joiners-movers-leavers, manage SSO config, support privileged access requests. ### Year 1–3 — IAM Engineer _Salary: £60k–£85k_ Implement SSO/SAML/OIDC integrations, lifecycle automation (SCIM), MFA rollouts, PAM (CyberArk/BeyondTrust). ### Year 3–5 — Senior IAM Engineer / IAM Architect _Salary: £85k–£115k_ Own IAM target-state architecture, zero-trust rollout, lead Entra ID / Okta / Ping platform engineering. ### Year 5+ — Principal IAM Engineer / Head of Identity _Salary: £115k–£160k+_ Own identity strategy, multi-IDP federation, CIAM, IGA platform selection. ## Core skills - OAuth 2.0 / OIDC / SAML 2.0 / SCIM 2.0 - Entra ID (Azure AD), Okta, Ping, ForgeRock - Privileged Access Management (CyberArk, BeyondTrust, Delinea) - Identity Governance (SailPoint, Saviynt, Omada) - Conditional Access policies + risk-based auth - Zero-trust principles (BeyondCorp, NIST 800-207) - Customer IAM (Auth0, Cognito, Entra External ID) - FIDO2 / WebAuthn / passkeys ## Recommended certifications - `azure-security` - `aws-security` - `cissp` - `ccsp` ## First 90 days in the role Inventory every identity store. Map every SaaS integration and its provisioning method (SCIM / JIT / manual). Identify the top 5 lifecycle gaps and propose automation. ## Common pitfalls Treating IAM as ticket work. Senior IAM engineers run programmes and platforms; juniors run tickets. Move into automation, IaC, and policy-as-code early.