Build the defenses
Identity & Access Management
Control who and what can reach each system, and keep proving that the access is still right.
The job, briefly
Identity and access management (IAM) covers accounts, sign-ins and permissions. IAM engineers and analysts run the identity provider employees sign in through, connect applications to single sign-on, enforce multi-factor authentication, automate accounts as people join, change jobs and leave, protect privileged and service accounts, and run the access reviews auditors ask for. Stolen credentials and hijacked sessions turn up in so many incidents that this work now sits near the center of most security programs.
Day to day
- Connect applications to single sign-on through SAML or OpenID Connect and retire their local passwords
- Roll out and harden MFA, moving people toward phishing-resistant methods such as passkeys and hardware security keys
- Automate joiner, mover and leaver processes from the HR system so access starts and stops on time
- Run privileged access management: vaulted admin credentials, just-in-time elevation and recorded sessions
- Inventory and clean up service accounts, API keys and other machine identities
- Run access reviews and certifications, then fix the role design problems they expose
Worked examples
Run a quarterly access review for the payments system
Auditors need evidence that access to the payments system is reviewed every quarter. You export every account and role, match accounts to people in the HR system and send each manager their team's access to approve or revoke. On the way you find four accounts belonging to people who left months ago and a contractor with administrator rights. You remove them, record who approved what and when, and open a ticket to fix the leaver process that missed them.
Move an application onto single sign-on
A sales tool still keeps its own usernames and passwords. You set it up as a SAML application in the identity provider, map groups to roles inside the tool, test with a pilot group, enable SCIM provisioning so accounts are created and removed automatically, then switch off local login. People who leave now lose access when HR records their departure, not whenever someone remembers.
Respond to an MFA fatigue attack
An employee reports a stream of push prompts they never requested. The sign-in logs confirm someone has their password and is hoping for an accidental approval. You reset the password, revoke sessions and block the source addresses, then fix the cause for everyone: number matching on push prompts, limits on repeated requests and a plan to move high-risk groups to passkeys.
Who does well here
IAM suits system administrators, help desk leads and Active Directory or Microsoft 365 administrators who already manage accounts and groups, and developers who know authentication protocols. It rewards patience with process, care with detail and the ability to work with HR, auditors and application owners as easily as with engineers. Among security specialties it is one of the more reachable from IT operations.
Signs it suits you
- You already manage user accounts, groups or Active Directory as part of your job
- You like turning a messy manual process into a reliable automatic one
- You can explain to someone why they do not need the access they are asking for
- Protocol details such as SAML assertions, OAuth scopes and token lifetimes interest you
Requirements
- Experience administering directories and identity: Active Directory, Entra ID, Okta, Google Workspace or similar
- An understanding of SAML, OAuth 2.0, OpenID Connect, Kerberos and LDAP
- Some scripting (PowerShell or Python) for automation, and comfort working with APIs
Useful skills
A route in
- 1Take on the identity work in your current IT job: onboarding and offboarding, group cleanup, SSO integrations, MFA rollouts
- 2Learn the protocols, not only the consoles: open a free developer tenant with Okta or Microsoft Entra ID and connect a few test applications
- 3Earn a vendor certification that matches the employers you want, such as Microsoft SC-300, an Okta certification, or SailPoint and CyberArk credentials for governance and privileged access
- 4Add Security+ if you hold no security credential yet, since many IAM jobs sit inside security teams that screen for it
- 5Write up an automation you built, such as a leaver script or a provisioning integration, with the before and after
- 6Apply for IAM analyst, IAM engineer and identity administrator roles; consultancies that implement identity products also hire and train juniors
Myths and reality
Myth: IAM is just password resets.
Reality: Password resets belong to the help desk. IAM teams design how access is granted, automate it across every application, protect the most powerful accounts and prove to auditors that all of it works. It is engineering and process design.
Myth: Once SSO and MFA are rolled out, identity is solved.
Reality: Attackers now steal session tokens, abuse OAuth consent, talk help desks into resetting MFA and use forgotten service accounts. Identity work keeps moving toward detection and response on sign-ins, phishing-resistant authentication and machine identities.
Myth: IAM is not really a security job.
Reality: Stolen and misused credentials appear again and again in incident reports, and many IAM teams now report into the security organization. Identity threat detection and response has grown into its own field within the specialty.
Salary
Salary ranges on open IAM roles currently center on $192k–$306k/yr. The median sits at $225000, measured over the 58 openings that publish a range.
Questions career changers ask
Is IAM a good way into cybersecurity from IT support?
It is one of the most natural. Help desk and administration work already involves accounts, groups and permissions, so the jump is shorter than into most security specialties. Lean into the identity side of your current job, learn the protocols properly, and IAM analyst roles become realistic.
What is the difference between IAM, IGA and PAM?
IAM is the umbrella: identities, authentication and access. Identity governance and administration (IGA) covers the lifecycle and the proof: provisioning, role design, access requests and certifications, with tools such as SailPoint and Saviynt. Privileged access management (PAM) protects administrator and other powerful accounts through vaulting, just-in-time access and session monitoring, with tools such as CyberArk. Many roles concentrate on one of the three.
Do IAM roles involve coding?
Increasingly. Provisioning connectors, automation scripts, API integrations and infrastructure as code for identity settings are common, especially in engineering roles. Analyst and administrator roles lean more on configuration and process, but PowerShell or Python helps everywhere.
Which certification matters most for IAM?
There is no single one. Certifications for the product an employer runs (Okta, Microsoft SC-300, SailPoint, CyberArk) are often named in postings. CISSP becomes useful later for senior and architecture roles, where identity meets security architecture.
Neighboring paths
Cloud Security
Put guardrails, identity policies and monitoring around workloads on AWS, Azure and Google Cloud.
Governance, Risk & Compliance (GRC)
Translate security into frameworks, evidence and risk decisions that auditors, customers and executives accept.
Security Engineering
Design, build and run the security controls and tooling the rest of the company relies on.