How to Become an IAM Engineer, From What 120 Open Postings Ask For

What identity and access management engineers actually do, the platforms and protocols 120 open postings name, what each rung pays, and the realistic ways into the field from IT, cloud and software work.

An IAM engineer decides, and then enforces in software, who and what may reach each system an organization runs: they operate the identity provider everyone signs in through, wire applications into single sign-on and multi-factor authentication, automate accounts as people join, change teams and leave, lock down administrator and service accounts, and produce the evidence auditors ask for. Very few people start their career in this seat. Of the 120 identity postings CyberJobs.cc read in full on 12 November 2026, exactly one was written for a beginner, and the typical posting that stated an experience bar asked for seven years. The people who close that distance usually arrive from IT administration, where accounts, groups and directories are already the daily work, from cloud engineering, where permissions policies are, or from software development, where identity products get built. The rest of this guide lays out what those postings ask for and pay, and how to turn the job you hold now into the proof they want.

Where the numbers come from. The sample begins with every open role the board filed under identity and access management on 12 November 2026 (111 roles, from the complete job feed built at 23:01 UTC the night before). Two were removed because "Digital Identity" was only the name of a business unit: a maintenance technician and a health and safety specialist at a Thales plant in Italy. Eleven were added from other specialties because their titles name identity, IAM, authentication, Active Directory or Entra ID: an authentication engineering manager at GitLab, two Okta managers (customer identity and identity governance), identity governance and IAM engineers at Nscale and Coupang, identity software roles at MongoDB, Snowflake and Abnormal Security, and three Active Directory and Entra ID architects at GuidePoint Security and AvePoint. A product designer's posting and a compliance director whose "authorization" meant a government accreditation were left out. That leaves 120 postings from 70 employers, each read from first line to last and counted for its level, its duties, the products, protocols and languages it names, the experience and education it requires, the certifications it mentions, its workplace and the pay it prints. Three are in Korean or Japanese, so keyword tallies may miss a few of their mentions. Salary figures use only the ranges employers printed themselves. Where the board can count something itself, the number below is a live figure that refreshes with the page; as you read this, the board holds 111 open identity and access roles. Every outside number is cited to the page it comes from, with that page's date.

Contents

1. What an IAM engineer does, one access decision at a time
2. Four jobs under one name: operators, builders, advisers and leads
3. The platforms and protocols 120 postings name
4. Analyst, engineer, architect: the rungs and the years
5. A learning plan, ordered the way access flows
6. Routes in from help desk, sysadmin, cloud and development
7. IAM certifications: which ones postings mention, and how many mention none
8. IAM engineer salary by level and kind of seat
9. Identity as the new perimeter: attacks, passkeys, machines and AI agents
10. Remote work, on-call and where the seats are
11. IAM engineer questions, answered

1. What an IAM engineer does, one access decision at a time

Start with the economics, because they explain every task that follows. Each permission an organization grants is cheap to create and expensive to forget. An account that outlives its owner, a group that quietly gives forty people administrator rights, an API key pasted into a build script three years ago: none of these cost anything on the day they appear, and all of them become the attacker's route in on the day something goes wrong. Granting too little access has a cost as well, paid in blocked work, tickets and people sharing passwords to get around the system. Identity engineering is the discipline of holding both costs down at once. Its product is not a login screen. It is a record of access decisions that are correct now and can be explained later to an auditor, an incident responder or a court.

A working day, followed through

Picture a mid-sized software company on an ordinary Tuesday, and the identity engineer who looks after its sign-in system.

9:10, a new application. The finance team has bought an expense tool and wants it live by Friday. The engineer registers it in the identity provider as a SAML or OpenID Connect application, decides which groups should reach it, maps those groups to the roles inside the tool, and turns on SCIM provisioning so accounts are created and disabled automatically instead of by hand. Then the local username and password login inside the tool is switched off, because a second way in is a second thing to forget. Marqeta's posting for a Security Engineer II describes exactly this loop: configuring Okta single sign-on, MFA, lifecycle management and policies, "including SAML/OIDC app integrations and SCIM provisioning."

11:00, a mover. A support engineer has transferred into the sales team. The human resources system records the change; the identity platform should now add sales access and, just as importantly, remove the support tooling access the person no longer needs. Movers are where access quietly accumulates, because adding feels urgent and removing never does. Twenty-four percent of the sample's postings mention access reviews or certification campaigns, the periodic check that catches what automation missed.

13:30, a privileged request. A database administrator needs production access to fix a failed migration. Instead of a permanent administrator account, the request goes through a privileged access tool: approved, time-limited, recorded, and gone again in two hours. Postings call this just-in-time access or zero standing privilege, and 22% of them name one or the other.

15:45, something looks wrong. The sign-in logs show a burst of push prompts sent to one employee within a few minutes, from a country the company has no staff in. That pattern has a name in MITRE's catalogue of attacker techniques, multi-factor authentication request generation, in which the attacker floods a user with prompts hoping one gets approved - MITRE ATT&CK T1621. The engineer revokes the person's sessions, resets the password with the employee on a video call, blocks the source, and opens a change to move that group onto phishing-resistant sign-in.

17:20, a leaver. Someone's last day ends. Their account is disabled by the HR feed, their active sessions and refresh tokens are revoked, the OAuth grants they gave to third-party apps are removed, and ownership of the service accounts they created moves to their manager. If any of that depended on a person remembering, it is the engineer's next automation project.

None of these moments is exotic, and that is the point. The work is a stream of small access decisions, and the engineer's real job is to make each one happen automatically, the same way every time, with a log line that proves it.

How often each duty shows up

Across all 120 postings, 44% describe provisioning, deprovisioning or the joiner-mover-leaver lifecycle, 44% mention privileged access, 28% identity governance, 24% access reviews, and 30% name a compliance regime the identity team has to satisfy (SOX, SOC 2, FedRAMP, ISO 27001, PCI DSS, HIPAA or HITRUST). Those shares rise sharply when you look only at the 40 postings for engineers who run an organization's own identity estate (section 2 explains the split): 85% of them mention lifecycle work, 75% privileged access, 55% governance and 50% access reviews. Incidents feature in 28% of all postings, and on-call duty in 18%.

2. Four jobs under one name: operators, builders, advisers and leads

Search any job site for "IAM engineer" and you will be shown at least four different jobs. Sorting the 120 titles by the work they describe produces this split:

Operators are what most people picture. Elastic's Okta Identity Engineer sits in the company's IT team and designs, integrates and automates its Okta estate. Cloudflare had two IAM security engineer seats open whose owner builds and runs an access certification platform and a privileged access platform, with an on-call rotation that "may include after hours calls." CrowdStrike's senior IAM engineer handles identity provider operations and joins the on-call rotation for its federal cloud support. These are the seats a person from IT administration grows into.

Builders are the largest group, and the one career advice most often forgets. Thirty-nine percent of the sample were software engineer titles on teams that build identity into a product or platform. Coinbase was hiring a senior staff engineer to unify "human, AI agent, service, and workload identity into one coherent platform," noting that access touches more than 700 internal systems. Roblox's IAM team owns the machine and workload identity platform behind production, a central authorization engine and just-in-time access for engineers. Fastly wanted a staff engineer for its customer identity team, which builds the authentication, authorization and profile services Fastly's customers use to control their own users' access. These seats ask for software engineering first and identity second, and section 7 shows that not one of the 47 named a certification.

Advisers design identity programs for someone else. Palo Alto Networks had three identity domain consultant seats (in Singapore, Japan and Canada), who work alongside sales teams and customers to design identity deployments. GuidePoint Security and Trace3 hire consultants and solutions architects who implement identity products at client companies. AvePoint was hiring principal architects for Active Directory and Entra ID recovery, a specialty that exists because a destroyed directory stops an entire company.

Leads run teams, and 16 postings were management titles, from engineering managers at Databricks, Adyen and Okta to a director of customer identity at Nscale.

Who employs them

By the board's employer groups, the 120 postings came from cloud, data and infrastructure companies (40), security software vendors (30), software and internet companies (23), finance, payments and crypto firms (13), security consultancies and managed services (8), defense and aerospace (3) and companies building AI models (3). That mix matters for reading everything below: this board reads the hiring systems of technology-heavy employers, so it sees more builders and fewer seats at banks, hospitals and universities than a general job site would.

The title vocabulary

Forty-one titles used the acronym IAM and 37 spelled out "identity and access", so search for both. Twelve said identity security or identity threat, seven privileged access or PAM, five governance or IGA, four customer identity or CIAM, and four non-human, machine or service identity. Only eight titles named a product (Okta, Entra ID, Active Directory, SailPoint or CyberArk). The most striking absence: not one title in the sample, nor any of the board's 2,150 open roles, said "IAM analyst" or "identity analyst", apart from a quality-assurance analyst testing a privileged access product. Section 4 explains what that means for a newcomer.

3. The platforms and protocols 120 postings name

Each item is counted once per posting, required or merely welcome, because few postings draw that line clearly. Products come first, because they are what screeners search résumés for.

Okta leads, named in 43 postings at 34 employers (39 of them at employers other than Okta itself). Microsoft's identity stack is close behind: Entra ID or its old name Azure AD appeared in 27 postings and on-premises Active Directory, counted separately, in 27, with 37 postings naming one or the other. The governance product SailPoint appeared in 21, Saviynt in 9 and newer governance tools ( Lumos, ConductorOne, Opal, Veza) in 6. For privileged access, CyberArk was named in 12, HashiCorp Vault in 12 (often for secrets rather than people), and BeyondTrust and Delinea in 3 and 2. Ping Identity appeared in 10, Auth0 in 6, Google Workspace in 5, Keycloak in 3 and ForgeRock in 2. Cloud permissions came up constantly: AWS in 49 postings, Google Cloud in 32, Azure in 30, Kubernetes in 33, and AWS IAM by name in 11.

Two readings follow. First, one product is not a career: no single platform appears in even two postings out of five, so an engineer who knows only one console is employable at a fraction of the market. Second, the products share a small set of open standards, and those standards are what the postings name most.

The protocols underneath

Each of these has a precise job. OAuth 2.0 lets an application obtain limited access to a service on a user's behalf without seeing their password; its core document dates from October 2012 - RFC 6749. OpenID Connect is "a simple identity layer on top of the OAuth 2.0 protocol" that adds a signed ID token saying who signed in, and its current text incorporates errata set 2 from 15 December 2023 - OpenID Foundation. SAML, the older XML-based federation standard most enterprise software still speaks, was approved as an OASIS standard in March 2005 - OASIS SAML 2.0 technical overview. SCIM is the HTTP protocol that creates, updates and disables accounts across systems, published in September 2015 - RFC 7644.

The protocol most worth reading in full is the one employers rarely name: the IETF's OAuth security best practice, published in January 2025, which bans the grant in which an application collects the user's password itself, steers clients away from the implicit grant, and makes PKCE mandatory for public clients - RFC 9700. Interviewers who build identity systems ask about precisely these points.

Kerberos and LDAP look rare in the table only because postings say "Active Directory" instead; Kerberos is the default authentication protocol of a Windows domain, and an engineer defending a directory needs it.

Operators name products, builders name languages

The split between the two biggest kinds of seat is clearer here than anywhere else.

Operator postings are product-heavy: 58% name Okta, 52% Entra ID or Active Directory, 40% SailPoint, and half name a governance product of some kind. They also script. Python appears in 62% of operator postings and PowerShell in 35%; 42% named Terraform, and 55% asked for some form of infrastructure as code. Builder postings barely mention products at all (2 of 47 named SailPoint, one named Entra ID) and ask instead for Go (55%), Java (43%) and Kubernetes (47%). Both camps share the protocols: SAML, OAuth or OpenID Connect appear in 70% of operator postings and 57% of builder ones.

The practical lesson is to decide early which camp you are aiming for, because the study plans diverge. An operator learns two or three platforms deeply and automates them. A builder learns the standards well enough to implement them correctly in code.

4. Analyst, engineer, architect: the rungs and the years

Classic career ladders describe identity work in three rungs: analyst, engineer and architect. The postings tell a more specific story.

The experience column needs a word on method. Many postings state two figures, such as eight years of software engineering including three in identity. The table uses the larger one, because that is the bar a screener applies; using the smaller one would make management seats look like junior ones.

Three things in this picture deserve attention. A plain title, with no level in it, is not a starting seat: those postings' median bar was five and a half years, slightly above the senior median, a sign that employers who leave the level out are mostly hiring at mid or senior level. Only 7 of the 92 postings that stated a figure asked for three years or less, while 42 asked for eight or more. And the step from senior to staff is the expensive one, from five years to eight, matched by a jump of roughly $35,000 at the pay midpoint.

By kind of seat, the median operator posting wanted five years, the median builder posting eight, advisory postings nine and management postings eight. Operations is the shallowest end of the pool, which is why it is where most people enter.

Where the analyst rung went

Advice written for the field usually starts at "IAM analyst", the person who processes access requests, runs reviews and administers the directory. On this board that title does not exist: zero of 2,150 open roles. Two things explain it. The employers this board reads (technology, security, cloud and finance companies on modern hiring systems) title even their most junior identity seats as engineers, and much of the request-processing an analyst once did is now automated by the very SCIM feeds and approval workflows that section 1 described. Organisations outside that set, such as universities, health systems, government bodies and many banks, also run identity teams and keep administration-heavy seats, so an analyst job remains a real first step; it simply sits at employers this board does not yet cover.

What the analyst work looks like inside a tech company is visible in the board's one true entry posting. Nebius was recruiting a Junior Identity & Access Engineer (Early Talent) in Prague for a paid three-month placement starting January 2027, open to final-year students, recent graduates and early-career specialists. The duties read like an analyst's: processing access requests and license changes from runbooks, running onboarding and offboarding checklists, first-line triage of sign-in problems "from sign-in and audit logs," testing SSO and SCIM mappings in non-production, and reporting on stale accounts and unused licenses with PowerShell and Microsoft Graph. A senior engineer reviews the work, and production changes are not expected unsupervised in the first months. The posting asks for coursework or self-study on authentication versus authorization, MFA, SSO and least privilege, basic scripting, and "methodical troubleshooting: you read the documentation and the logs before guessing." Nice to have: Microsoft fundamentals certifications, a homelab or test tenant, and part-time experience in IT support or a service desk.

That posting is the clearest map in the sample of what a first identity job contains. If you can do everything on its list, you are ready for one.

The architect rung

Nine titles carried the word architect. They are not entry points into anything: AvePoint's principal architects for identity resilience asked for 12 or more years of hands-on identity infrastructure work, and OpenLoop Health's senior staff IAM architect asked for eight years in identity, security engineering or platform architecture, at least three of them at staff, principal or architect level. The architect owns the shape of identity across the company: which directory has the final word on who exists, how workforce, customer and machine identities relate, where authorization decisions are made and how the design survives an audit. People reach it by having built and broken most of those pieces themselves.

5. A learning plan, ordered the way access flows

The order below follows how an access decision actually flows: a person exists in a directory, proves who they are, receives access, keeps or loses it over time, and occasionally holds dangerous power. Every step is a foundation for the one after it.

Step 1: directories and the vocabulary of access

Learn what a directory holds (users, groups, organizational units, devices) and how Active Directory and Entra ID relate: the first is the on-premises domain that still runs many companies, the second is Microsoft's cloud identity service, and most large organizations run both, synchronized. Learn the distinction every interview opens with: authentication proves who someone is, authorization decides what they may do. Build a small domain in virtual machines, join a machine to it, create groups, and watch what a group membership change does to file access. Active Directory or Entra ID appears in 52% of operator postings, so this is not optional for that camp.

Step 2: federation, done by hand

Next, learn single sign-on as a protocol rather than as a checkbox. Set up an identity provider (Keycloak, an open-source identity server that supports OpenID Connect, OAuth 2.0 and SAML and is a Cloud Native Computing Foundation incubation project, runs on a laptop - Keycloak), connect a test application with SAML and another with OpenID Connect, and read what crosses the wire. Capture a SAML assertion in the browser's developer tools and find the subject, the audience and the signature. Decode an OpenID Connect ID token and read its claims.

A short Python script makes token claims readable. It does not check the signature, so use it only to look, never to trust:

# Print the header and claims of a JWT (for example an OpenID Connect ID token).
# This does NOT verify the signature: never use it to make an access decision.
import base64, json, sys

def decode_part(part: str) -> dict:
    padded = part + "=" * (-len(part) % 4)  # restore base64url padding
    return json.loads(base64.urlsafe_b64decode(padded))

header, payload, _signature = sys.argv [1].split(".")
print(json.dumps(decode_part(header), indent=2))
print(json.dumps(decode_part(payload), indent=2))

Run it on a token from your test setup and you will see iss (who issued it), sub (who it is about), aud (which application it is for) and exp (when it stops being valid). Those four claims, and what goes wrong when an application fails to check them, account for a large share of identity bugs.

Step 3: provisioning and the lifecycle

Learn SCIM, because 55% of operator postings and a third of builder postings name it. A SCIM-connected application exposes a standard endpoint, and the identity platform calls it to create, change and disable accounts. Creating a user looks like this, using the core schema the standard defines:

POST /scim/v2/Users
{
  "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
  "userName": "jdoe@example.com",
  "name": { "givenName": "Jane", "familyName": "Doe" },
  "emails": [{ "value": "jdoe@example.com", "primary": true }],
  "active": true
}

And the leaver, the call that matters most, is a patch that switches the account off:

PATCH /scim/v2/Users/2819c223-7f76-453a-919d-413861904646
{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:PatchOp"],
  "Operations": [{ "op": "replace", "path": "active", "value": false }]
}

Then learn the design around those calls: the HR record treated as the authority on who works there, "birthright" access granted by role on the first day, and approvals for everything beyond it. Joiner-mover-leaver is the identity team's core process, and 85% of operator postings describe it in some form.

Step 4: automation and identity as code

Operators automate. Learn PowerShell with Microsoft Graph if you are heading for Microsoft-centred estates (35% of operator postings named PowerShell, every one of them an operator or adviser seat), and Python against a platform's REST API for everything else. Then learn Terraform, which 42% of operator postings named: Ramp described its identity configuration as living in Terraform, and GuidePoint's CIAM consultant posting asked for experience managing Okta through its Terraform provider, with Git-based version control and CI/CD pipelines. The shift from clicking in a console to reviewing changes in a pull request is the single biggest marker separating a senior identity engineer from an administrator.

Step 5: governance and privileged access

Learn how access reviews work and why they fail (reviewers rubber-stamp lists they cannot interpret), how role design reduces the size of those lists, and what segregation of duties means (the person who creates a vendor should not also pay it). Then learn privileged access: vaulted credentials, session recording, and just-in-time elevation that expires on its own. Privileged access appears in 75% of operator postings.

Step 6: cloud and workload identity

Cloud platforms are identity systems with computers attached. Learn AWS IAM policies and roles, how Azure and Google Cloud assign permissions, and how Kubernetes service accounts work. Then learn workload identity, the practice of giving software its own short-lived, verifiable identity instead of a long-lived secret. SPIFFE, a framework and set of standards for identifying and securing communication between services, is a graduated Cloud Native Computing Foundation project - SPIFFE. Workload identity or SPIFFE appeared in 18% of postings, and secrets, service accounts or non-human identities in 38%.

Step 7: detection on identity

Learn to read sign-in and audit logs the way a SOC analyst does, and learn the attacks on directories: Kerberoasting, in which an attacker requests service tickets for accounts with service principal names and cracks them offline - MITRE ATT&CK T1558.003, MFA fatigue, session token theft and malicious OAuth consent. Identity threat detection and response, or ITDR, appeared in 17% of postings. The SOC analyst guide covers the investigation side of this work in depth.

Step 8: writing for auditors and engineers

Identity teams answer to two audiences that speak different languages. Auditors want evidence that a control works; engineers want a design they can adopt without friction. Practise writing a one-page control description (what the control is, how it runs, where its evidence lives) and a one-page design proposal for a developer audience. Both show up in interviews, and both are rare skills.

6. Routes in from help desk, sysadmin, cloud and development

The postings make one thing plain: identity is learned on the job, and the job that teaches it fastest is one that already touches accounts. Here are the doors, roughly in order of how many people they carry.

From the help desk or service desk

The service desk resets passwords, unlocks accounts, sets up new starters and fields "I can't log in" all day. That is identity work at its most manual, and the engineers who automate it often started by doing it. Crusoe's senior systems engineer for IAM is described as the tier 2 escalation point for complex access issues, supporting the service desk and mentoring its staff, which tells you where that team expects its identity talent to come from.

The labour market adds a reason to move. US government projections expect employment of computer user support specialists to fall 3% between 2025 and 2035, with a median wage of $61,860 in May 2025 - US Bureau of Labor Statistics. The nearest federal category to identity security, information security analysts, is expected to grow 21% across that decade, and its median pay sits at $129,180 - BLS.

The move from the desk works best in deliberate steps. Volunteer for every ticket that touches access rather than devices: new application requests, group changes, MFA enrollment problems, offboarding. Learn which of those could be automated, then automate one, starting with the leaver checklist, because it is the process with the highest security value and the least glamour. Ask the identity or systems team for read access to the identity provider's admin console and sit in on one integration. A year of this produces exactly the evidence the Nebius posting asked for.

From systems administration

A Windows or Microsoft 365 administrator is usually one job away from an identity seat. Group Policy, domain controllers, Entra Connect synchronization, conditional access and license management are already in the job. US projections put network and computer systems administrators at a median of $99,130 in May 2025, with employment expected to fall 4% from 2025 to 2035 - BLS. NETGEAR's Senior Microsoft 365 & Identity Engineer in Cork and RELEX Solutions' Senior IAM Engineer for Entra ID are the kinds of seats this route reaches first: one platform, owned end to end, with Microsoft identity certifications as a plus. The skill to add is the one administrators often lack: automation in PowerShell with Microsoft Graph, kept in version control.

From cloud and platform engineering

Cloud engineers already write IAM policies, assume roles and manage service accounts. Forty-one percent of the identity postings named AWS and 28% Kubernetes, and the workload identity work in section 5 is often owned by platform teams before an identity team exists. The shortest move is into an identity platform team that runs access for engineers: just-in-time production access, short-lived credentials, secrets management. The sibling cloud security engineer guide covers the broader cloud route.

From software development

Developers have the widest door and the best-paid one. The 47 builder postings ask for engineering skill first: Affirm's Product Security Engineer II for IAM wanted two years as a software engineer, and MongoDB, Brex, Hadrian, Elastic and Klaviyo all had identity software roles open at mid and senior levels. What a developer adds is depth in the standards: implementing OAuth and OpenID Connect flows correctly, designing authorization models (role-based, attribute-based and relationship-based access appeared in 36% of builder postings, and policy engines such as OPA or Cedar in 19%), and handling tokens safely. The security engineer guide covers the neighbouring path into product and infrastructure security.

From security operations or GRC

Two smaller routes run from inside security. SOC analysts investigate compromised accounts constantly, and identity threat detection is a natural specialty to grow into. GRC analysts run the access reviews and segregation-of-duties testing that identity teams must satisfy, and some cross over to own the governance tooling itself; the GRC analyst guide describes that side.

Through a consultancy

Identity products are hard to deploy, so firms exist to deploy them. Cyderes was hiring a CyberArk security engineer in India asking for two to five years of administration and a SailPoint Identity Security Cloud engineer asking for three years of hands-on work; GuidePoint Security, Trace3 and Palo Alto Networks' identity consultants work across many client estates. Consulting compresses experience, because each client is a new directory, a new set of applications and a new mess, but it rarely hires beginners; it suits someone with a year or two of platform administration who wants breadth fast.

Proof that stands in for experience

Whichever door you use, the gap to close is evidence. Four kinds persuade identity hiring managers:

1. A working lab. A directory, an identity provider, two applications federated with SAML and OpenID Connect, SCIM provisioning into one of them, and a written description of each design choice.
2. An automation with a before and after. A leaver script, a stale-account report, an access review export: anything that turned a manual process into a reliable one, with a note on what it saves.
3. A short design write-up. How you would move a 500-person company from shared administrator passwords to just-in-time access, in two pages.
4. Identity as code in a public repository. Terraform or scripts managing your lab's configuration, with reviewed changes.

Then present them so a screener can find them. The cybersecurity résumé guide turns lab work and automations into lines a screener recognizes as experience. For the conversation itself, the interview questions guide has the protocol and design questions identity interviewers favour, and the board's interview practice lets you answer them aloud and get written feedback. Readers not yet settled on identity will find the entry routes for each specialty laid out in how to get into cybersecurity, and identity compared with the other nine in the career paths guide.

7. IAM certifications: which ones postings mention, and how many mention none

The short answer is that most identity postings name no certification at all: 88 of the 120 (73%) mentioned none. Board-wide, 26.3% of all open security postings name one, according to the certifications page (read 11 November 2026, 23:07 UTC), so identity sits right at the security average.

Who asks matters more than the overall rate. Not one of the 47 builder postings named a certification. Among operator postings, 18 of 40 (45%) named at least one; among adviser postings, 12 of 13; among leads, 2 of 16. Certifications, in other words, are a currency for people who configure products and advise clients, and almost irrelevant to people who write identity software.

The CISSP is the most-named single credential, in 19 postings at 12 employers, but read the context: it clustered in senior, principal, architect and consulting seats, as a nice-to-have in a list. ISC2 grants it only after five years of full-time employment across at least two of the eight areas the exam covers, although candidates may pass the exam first and then have six years, as Associates, to build up that experience - ISC2. It belongs to mid-career, not to the first application; the CISSP page lists the open roles that mention it.

Microsoft's identity and security certifications came next, in 11 postings at 7 employers, with the Identity and Access Administrator exam, SC-300, named in 7 of them (Delinea, NETGEAR, RELEX Solutions, GuidePoint Security and three AvePoint seats). Across all specialties, the board counted 16 postings naming Microsoft's security certifications, and identity was the specialty that named them most - Microsoft security certifications page. Microsoft describes the certification as covering the design, implementation and operation of identity on Entra, with an exam that assesses user identities, authentication and access management, workload identities and identity governance; it allows 100 minutes, must be renewed every 12 months through a free online assessment, and its English exam was updated on 28 October 2026 - Microsoft Learn.

Okta's certifications were named in 9 postings at 8 employers, including Marqeta, HackerOne, Trace3 (which called one "strongly preferred") and Crusoe. Legora's staff identity engineer posting summed up the employer view in one line: "Okta certifications are useful, but demonstrated engineering depth and ownership matter most."

Vendor-neutral identity credentials are rare in postings. IDPro's CIDPRO, which the professional body describes as a vendor-neutral certification for core identity knowledge with a $750 exam fee - IDPro, was named twice (Delinea and HackerOne), and Marqeta named the CIAM and CAMS credentials twice.

Mandatory certifications were almost non-existent. Only two postings made one a hard requirement: Cyderes' CyberArk engineer seat, which called CyberArk's Defender or Sentry credential mandatory, and Palo Alto Networks' Singapore domain consultant, which required an active cloud certification. Everywhere else a certification was a preference.

A sensible order

Match the certification to the platform your target employers run, and take it after you have used that platform, not instead of using it. For a Microsoft-centred estate, SC-300 is the most-named product credential. For Okta shops, Okta's administrator-level certification. For governance or privileged access specialists, the SailPoint or CyberArk credential for the product you actually administer. Save the CISSP for when you have the experience it demands, and if builder seats are your goal, skip certifications and spend the hours on code. For the whole board rather than identity alone, the certifications page refreshes its tally of every credential hourly.

8. IAM engineer salary by level and kind of seat

Identity pays well by security's standards. As a yardstick, federal statistics for May 2025 show information security analysts (a wider group than identity) earning a median of $129,180, with the best-paid tenth above $199,850 - BLS. The employers this board reads pay well above that benchmark, because they are mostly technology companies publishing ranges for senior engineers.

The board's IAM engineer salary page gave identity and access management a typical yearly band of $192,000 to $306,000 and a middle of $225,000, from 54 distinct ranges at 40 employers (read 11 November 2026, 23:07 UTC). That figure is recounted every hour; as you read this the middle stands at $225k/yr, with the usual band running from $192k/yr to $306k/yr. The career paths guide found that identity carried the highest middle pay of any specialty outside leadership on 11 November.

In this sample, 56 US postings at 39 employers printed a true salary range (Canadian postings and single figures left out). Their median midpoint was $227,250, the median bottom of a range $189,000 and the median top $268,300.

The kind of seat moves pay as much as the level. US operator postings had a median midpoint of $200,000 across 15 ranges, builder postings $233,000 across 27, and management postings $237,550 across 10. At the same senior level, operators came out at $193,000 and builders at $213,375. That gap, around $20,000 to $35,000, is what the market pays for being able to write identity software rather than configure it.

The two director-level ranges were wide: Applied Intuition's head of IAM at $230,000 to $275,000 and Nscale's director of customer identity at $230,000 to $400,000.

The ranges closest to the bottom of the ladder

Few identity postings at the lower levels print a range, so the individual ones are worth seeing. These are the US postings with the lowest ranges in the sample, where most career-changers will first compete:

Three patterns stand out. The lowest bottom in the sample, Elastic's $94,300, belongs to a seat asking for five years of IT and three of Okta, so even the floor of this market assumes experience. A single range can be enormous: xAI's IAM engineer spans $98,000 between bottom and top, which usually means the employer will hire at more than one level. And at the high end, the best-paid ranges all belonged to builders: Roblox's principal security software engineer for IAM at $326,060 to $385,050, and Harvey's staff security software engineer at $231,000 to $340,000.

Employer, workplace and country

The salary page splits the market further. Software and internet companies had the highest middle ($251,000, from 14 ranges), followed by cloud, data and infrastructure ($226,000, 23), finance, payments and crypto ($208,000, 7) and security software companies ($199,000, 8). On workplace, the page put remote identity roles at a middle of $208,000 and on-site or hybrid ones at $228,000, from 58 roles with a salary; this sample's US ranges came out nearly level ($227,700 remote against $225,625 for the rest), so treat remote as neither a reliable discount nor a premium. Identity titles can be set against every other security title on the highest-paying cybersecurity jobs list.

Outside the US, most identity postings print no range: 44 of the 120 were in other countries, led by India (12), Canada (6) and the Czech Republic (5). For those, the salary calculator checks an offer against ranges printed for comparable seats, and asking the recruiter for the band in the first call is usually the quickest way to a real number.

9. Identity as the new perimeter: attacks, passkeys, machines and AI agents

Reason from first principles about where a company's boundary now sits. A decade ago the boundary was a network: inside the firewall was trusted, outside was not. Then the applications moved to software-as-a-service, the servers moved to cloud accounts, and the employees moved home. What is left that every request must pass through is a sign-in: an identity, a credential, a session and a set of permissions. If that is the boundary, then the cheapest attack is not breaking through it but logging in, and the people who design sign-in are doing perimeter defence.

The US government's zero trust model encodes the same idea. CISA's Zero Trust Maturity Model (version 2.0, April 2023) makes identity the first of its five pillars, and its most mature stage for authentication is an agency that "continuously validates identity with phishing-resistant MFA, not just when access is initially granted," with access authorized "just-in-time and just-enough" - CISA Zero Trust Maturity Model. Zero trust appeared in 24% of the identity postings, least privilege in 28% and just-in-time or zero standing access in 22%.

What attacks on identity actually look like

The case record is consistent. In 2024, a financially motivated group stole data from Snowflake customer accounts using passwords taken by infostealer malware, some infections dating back to November 2020; Mandiant reported that for at least 79.7% of the hijacked accounts the credentials had leaked before, that none of the affected accounts had multi-factor authentication switched on, and that about 165 organizations were notified - Google Cloud, Mandiant, 10 June 2024. The same year, Microsoft disclosed that a nation-state actor had password-sprayed its way into a legacy, non-production test tenant account without MFA, then took over a legacy test OAuth application with elevated access and used it to reach corporate mailboxes - Microsoft Security, 25 January 2024.

Attackers who cannot steal a credential talk someone into handing one over. The joint FBI and CISA advisory on Scattered Spider, last updated on 29 July 2025, describes actors who pose as company IT or help desk staff and who "convince IT help desk personnel to reset passwords and/or transfer MFA tokens," alongside MFA fatigue and SIM swaps - CISA AA23-320A. That is why identity engineers now design help desk verification procedures, not only sign-in policies.

And attackers increasingly skip people altogether. In August 2025, Google's threat intelligence group reported that an actor it tracks as UNC6395 used compromised OAuth tokens belonging to the Salesloft Drift integration to export data from numerous corporate Salesforce instances, then searched the stolen data for further secrets such as AWS access keys - Google Cloud, 26 August 2025. No password was phished: a trusted application's token was enough.

The counter-evidence matters too. In May 2026, Verizon's breach report found that vulnerability exploitation, at 31% of breaches, had overtaken stolen credentials as the most common way in for the first time in 19 years - Verizon, 19 May 2026. Identity is not the only perimeter, and anyone who tells you it is has stopped reading the data. But exploitation is fought by patching and engineering teams, while every one of the cases above was stopped or enabled by an identity decision, which is why the field keeps growing.

Passkeys and phishing-resistant sign-in

The structural fix for stolen and phished passwords is a credential that cannot be typed into a fake page. Passkeys, built on the FIDO2 and WebAuthn standards, bind each sign-in to the real website's domain, so a lookalike site receives nothing useful. NIST's digital identity guidelines, finalized on 31 July 2025 as SP 800-63-4 - NIST CSRC, now oblige services at the middle assurance level (AAL2) to make a phishing-resistant method available, require a phishing-resistant authenticator at the highest level (AAL3), and allow syncable passkeys at AAL2 but not at AAL3. The same volume drops forced password rotation and composition rules and sets a 15-character minimum for passwords used on their own - NIST SP 800-63B-4.

Adoption is real but uneven. Across 15 large consumer services, passkeys carried 36% of successful sign-ins in the FIDO Alliance's index compiled in September 2026, up from 26% a year earlier, and passkey sign-ins succeeded 93% of the time against 78% for traditional MFA - FIDO Alliance Passkey Index, October 2026. For employees, 68% of 1,400 organizations surveyed in April 2026 said they were deploying, piloting or rolling out passkeys - FIDO Alliance, 7 May 2026.

The postings lag the trend. FIDO2, WebAuthn or passkeys appeared in only 12 of 120 postings, nine of them builder seats where engineers implement passkey login in a product, and "phishing-resistant" in five. For a career-changer, that gap is an opportunity: a passkey rollout, with its recovery flows, device policies and help desk verification, is the kind of project that makes a mid-level operator senior, and few candidates can describe one.

Machine identities and AI agents

The fastest-growing part of the field has no people in it. Service accounts, API keys, workload credentials and OAuth integrations now carry much of the access in a modern company, and they fail in predictable ways. OWASP's Non-Human Identities Top 10 for 2025 lists them, starting with improper offboarding and secret leakage and running through overprivileged identities, long-lived secrets and humans using machine credentials - OWASP. Thirty-eight percent of the identity postings mentioned service accounts, secrets management or non-human identities. HackerOne's senior IAM engineer posting put the goal in one sentence: service accounts, workload identities, integrations and AI agents "each get an owner, a purpose, and an expiry, treated as the default rather than a cleanup project." OpenLoop Health's architect posting warned that service accounts and AI agents "are on track to outnumber the people we govern."

AI agents are already in the job descriptions. In 23 of the 120 postings (19%), the identity of AI agents was part of the role itself, not just the employer's marketing copy. Legora wanted authorization controls "for agent and MCP access, with clear permission boundaries." Palantir's identity team covers "workforce, customer, workload, and agentic" identities. Roblox expects agents to become first-class actors in production and wants its IAM engineers to work out how they receive identity, authenticate and get access. Okta's customer identity security manager reviews risks including "abuse of agentic protocols (MCP, A2A)."

Reasoned from first principles, an AI agent is a non-human identity that acts on a person's behalf, which is exactly the problem OAuth was designed for. The Model Context Protocol, the common way agents connect to tools, says so in its authorization specification: a protected MCP server acts as an OAuth 2.1 resource server, clients must name the exact server a token is for through resource indicators, and servers must accept only tokens issued for them and never pass one on - Model Context Protocol, 2026-07-28 revision. The skills that secure agents are therefore the skills in section 5, applied with more discipline: narrow scopes, short-lived tokens, an owner for every credential and a record of every grant. Security work on AI systems more broadly is listed on the AI security roles page.

10. Remote work, on-call and where the seats are

Remote work is common but not the norm. Thirty-two of the 120 postings (27%) were listed as fully remote: 11 of 40 operator seats, 12 of 47 builder seats and 6 of 13 adviser seats, the last because consultants work wherever clients are. Senior titles were remote most often (19 of 42), staff and principal titles least (4 of 36). Live, 30 of the 111 open identity roles are listed as remote, and the remote IAM jobs page groups them by employer; on 11 November it counted 30 remote openings at 20 employers, 6 of them open to applicants in any country.

On-call is real but lighter than in the SOC. Twenty-two postings (18%) describe an on-call rotation. Cloudflare's IAM engineers carry one that "may include after hours calls," xAI's join on-call rotation and incident response for identity systems, and Firmus noted that its identity function "runs 24/7" with first-line response sitting with operations. The reason is simple: when the identity provider fails, nobody in the company can work, so identity teams are paged like infrastructure teams.

Most seats are in the United States, but not all. Of the 120 postings, 65 were US-based, 44 were in other countries (India 12, Canada 6, the Czech Republic 5, Brazil 3, South Korea 3 and others), 7 were open to remote applicants worldwide, and 4 named no single country. The IAM engineer job title page lists every role titled IAM engineer with its location; on 11 November it held 61 such roles at 41 employers.

Clearances are rare. Only three postings mentioned a government clearance or background investigation: Anduril Industries (eligibility for a US Top Secret clearance), Palantir (a current clearance or eligibility to obtain one) and CrowdStrike (a criminal justice background check, as a plus). Four more limited the seat to US persons for export-control or FedRAMP reasons (xAI, two CoreWeave roles and Keeper Security). The cleared roles page collects the security jobs that require one.

Degrees are rarely a wall. Of the 117 postings in English, 41 mentioned a degree, and 35 of those either accepted equivalent experience or called it a preference. Six (5% of the English sample) made a degree a firm requirement: four at staff level or above, one senior advisory seat, and the junior early-talent seat, which recruits students and recent graduates.

Entry-level seats are scarce, so widen the net. The entry-level roles page gathers every starting-rung security role on the board; identity rarely has more than one or two at a time, so many people take their first security job in a neighbouring specialty and move into identity within a year or two. The identity and access management guide has worked examples of the job for readers deciding whether it fits.

11. IAM engineer questions, answered

What does an IAM engineer do?

An IAM engineer runs and improves the systems that decide who and what can access an organization's applications and data: the identity provider for sign-in and multi-factor authentication, the automation that opens and closes accounts through each person's arrival, internal moves and departure, administrator access, governance and access reviews for auditors, and increasingly the credentials of services and AI agents. In the 120 postings read for this guide, 44% described lifecycle work, 44% privileged access and 56% named SAML, OAuth or OpenID Connect.

How do I become an IAM engineer with no experience?

Almost nobody does it from nothing. Only one of 120 identity postings on 12 November 2026 was written for a beginner (a three-month early-talent seat in Prague), and only 7 of 92 postings that stated an experience bar asked for three years or less. The realistic route is to take a job that already touches accounts, such as a service desk or Microsoft 365 administration, take on every identity task in it, build a lab with federation and SCIM provisioning, and automate one real process. The board's identity and access management guide puts the usual first identity role one to two years into IT administration.

How much does an IAM engineer make?

On this board, US identity postings with a published range had a median midpoint of $227,250 on 12 November 2026, with senior titles at $197,000, staff at $232,500 and principal or lead titles at $254,000. The lowest range in the sample started at $94,300. Live, the board's salary page puts the middle at $225k/yr. For comparison, the federal figure for all information security analysts, a wider group, was a $129,180 median (May 2025).

What is the difference between an IAM analyst and an IAM engineer?

An analyst processes and checks access: requests, reviews, reports and directory administration, mostly following procedures. An engineer designs and automates the system those procedures run on. Technology companies increasingly title even junior identity seats as engineers: none of the 2,150 roles on this board on 12 November 2026 was titled IAM analyst, while organizations such as universities and health systems still hire analysts for administration-heavy identity work.

Does an IAM engineer need to code?

Scripting, yes; software engineering, only for builder seats. Three quarters of operator postings named a scripting language (Python in 62%, PowerShell in 35%) and 42% named Terraform. Builder postings, 39% of the sample, ask for real software engineering in languages such as Go (55% of them) and Java (43%), and pay more as a result.

Which IAM certification should I get first?

The one for the platform you will actually run. Seventy-three percent of identity postings named no certification, and no software engineering posting named one. Where they did, the CISSP (19 postings) clustered in senior and advisory seats, Microsoft's SC-300 and related exams appeared in 11, and Okta's certifications in 9. Only two postings made any certification mandatory.

Should I learn Okta or Microsoft Entra ID?

Learn the protocols first and one platform second, chosen by the employers you want. Okta was named in 36% of identity postings and Entra ID or Active Directory in 31%; among operator seats the figures were 58% and 52%. Many companies run both, with Active Directory on premises, Entra ID for Microsoft 365 and Okta in front of everything else, so the second platform is easy once the first is solid.

Is identity and access management a good career?

On the evidence, yes: identity had the highest middle pay of any non-leadership specialty on the board on 11 November 2026, it is the control behind many of the largest breaches of recent years, and passkeys, machine identities and AI agents are adding work faster than they remove it. The trade-offs are a high experience bar, on-call duty in about a fifth of postings, and a lot of patient work with auditors and application owners.

Can an IAM engineer work remotely?

Often. Twenty-seven percent of the identity postings were fully remote, rising to nearly half of consulting and architecture seats. On pay, the evidence is mixed: the salary page put remote roles' middle about $20,000 below on-site and hybrid ones on 11 November, while this sample's US ranges came out level. Beginners usually have better odds with an on-site or hybrid seat, where they can learn from the people who own the system.

How many years does the path to an IAM engineer job take?

From IT administration, the board's identity guide estimates one to two years before a first identity role: enough to own identity tasks, learn the protocols, build automations and show them. The postings then set their own bar: the median operator posting wanted five years. From software development, a move onto an identity team can happen within a single job change if you already have the engineering level the posting wants. From outside tech, plan on an IT role first.

The counts here come from 120 identity postings read on 12 November 2026, and every outside figure from the source linked beside it. Identity platforms, exam outlines and hiring habits shift fast: confirm today's details before you commit time or money to any of them.