Identity & Privileged Access
IAM Engineer
Identity appears in 87% of all security postings — the highest single topic in the corpus. This is the archetype that builds it.
The IAM engineer owns the plumbing that decides who exists, what they can reach, and how that changes as people join, move and leave. It is unglamorous and it is the substrate every other security control depends on: a perfect detection programme over a broken entitlement model is still a breach waiting to happen.
A day
| Time | What you are actually doing |
|---|---|
| 09:00 | A SCIM integration that stopped provisioning. The vendor changed a required attribute and now every new joiner fails silently. You find it because someone complained, not because it alerted — and fixing the alerting is the real ticket. |
| 10:30 | Design a joiner flow for a new job code. The goal is one access bundle attached to the role, not fifteen requests the developer has to discover for themselves. |
| 13:00 | An SoD rule. Finance want someone to both create vendors and approve payments during a leave period. You model the compensating control and put a date on it. |
| 14:30 | Federation. A new SaaS application, SAML, and the usual argument about whether their attribute mapping or ours changes. |
| 16:00 | Reconciliation code. Comparing the directory against the target system, because entitlements drift and the only way to know is to diff them on a schedule. |
The decisive round
“Design joiner-mover-leaver for a 5,000-person company.”
Interviewer: “Walk me through how access should work as someone joins, changes team, and leaves.”
A weak answer. “HR triggers the joiner process, we provision based on role, managers approve changes, and on termination we disable the account and revoke access.” Describes the happy path everyone already has. It says nothing about the mover case, which is where the real exposure sits, and nothing about the populations that fall outside HR.
A strong answer. “I'd design around the asymmetry that causes all the trouble: grants are automated and welcomed, revocations are a ticket somebody has to remember to file. So access only ever goes up, and after two moves a person holds the union of three roles.
Joiner is the easy one, and the thing I'd insist on is that access derives from the job code as a bundle, not cloned from a colleague. ‘Give them what Priya has’ propagates one person's accumulated access across the organisation and it is how a support engineer ends up with finance entitlements.
Mover is where I'd spend the effort, because it is the stage everyone under-builds. A role change must trigger revocation of the old bundle, not just addition of the new one, and that means someone has to decide what is genuinely shared across both roles. I'd default to full revoke and re-grant, with an exception path, because the alternative is that nothing is ever removed.
Leaver needs a measured time from termination to last access revoked, per system, because the reality is that the directory disables in minutes and three SaaS applications with no SCIM integration take weeks. I'd publish that number.
Then the two populations that break every design: contractors, who have no HR record, so they need a sponsor and a mandatory end date that shortens rather than extends by default; and service accounts, which have no lifecycle at all — every one needs a named human owner and an annual re-attestation, or you accumulate hundreds nobody can safely turn off.
And I'd run SoD checks preventively at request time rather than detectively in a quarterly campaign, because discovering a toxic combination three months later is far more expensive than never creating it.”
Mover, contractors, service accounts and preventive SoD are the four things that separate someone who has run this from someone who has read about it. Most candidates cover joiner and leaver and stop.
What to build
- A working SCIM provisioning flow between two systems, including the failure path when an attribute is missing. Provisioning that fails silently is the defining operational problem of this role.
- A reconciliation script that diffs directory entitlements against a target system and reports drift. Ten lines of logic, enormous practical value, and almost nobody has one.
- An SoD ruleset for a domain you understand, expressed as forbidden pairs, plus what the compensating control is when the business genuinely needs an exception.
- A leaver metric. Time from termination to last access revoked, per system. Even modelled on a hypothetical estate, bringing the shape of that measurement is a strong signal.
Real cases
Around 165 organisations had data stolen from their Snowflake tenants. The common factor was not a Snowflake vulnerability; it was customer accounts without MFA, reached with credentials harvested years earlier by infostealer malware.
Use it to say: “My takeaway is that credential validity outlives employment and detection. The control is enforced MFA on every path plus network policy, not user education about password reuse.”
Attackers reached a support case system holding HAR files that customers had uploaded for troubleshooting; those files contained live session tokens.
Use it to say: “It changed what I tell people to send to vendors. Debug bundles routinely contain live credentials and almost nobody scopes that in vendor review.”
A single unpatched domain controller in a remote office was the only surviving copy of the Active Directory that let the company rebuild.
Use it to say: “It is my argument that identity is a tier-zero recovery dependency. If the directory is gone, nothing else can be restored, and that is rarely reflected in DR plans.”
Compensation
| Market | Band | Notes |
|---|---|---|
| United States | $140k – $240k base | Engineering-heavy IAM roles pay well above IAM administration |
| India | ₹18L – ₹50L total | Very large GCC market — BFSI, healthcare, and the identity vendors themselves |
| Both | — | The differentiator is whether you write code. Console-configuration IAM is being compressed; policy-as-code and automation are not |
The book for this field
Identity & Access
Authentication versus authorisation, federation, the joiner-mover-leaver lifecycle, entitlements, privileged access, secrets, and machine identity.
Also read for this role
Microsoft 365 & Copilot in the Enterprise
How a Microsoft 365 estate is actually built, licensed and governed — tenant, identity, workloads, devices, Purview and Defender, every licence tier with current prices, and then Copilot and Copilot Studio from the request path to the evidence on whether they deliver.
All 12 chapters in Microsoft 365 & Copilot in the Enterprise →
Cross-cutting
Skills every archetype tests
These are shared across every field on this site — the same question asked in different vocabulary — so preparation here compounds rather than being spent once. The book above is specific to your field.
Practice the 11 Identity questions → · Back to Identity & Privileged Access →