IAM Engineer — what the role actually does
The hands-on engineer who configures the workforce IdP, builds JML automation, and shepherds SSO + SCIM integrations to dozens of SaaS apps.
TL;DR
The most common IAM role. Mid-level engineer who lives in the IdP admin console — Okta, Entra, JumpCloud, Auth0 workforce. Builds the integrations that let employees sign in to apps and get the right access automatically. Pairs with the security team but is fundamentally an enabler, not a gatekeeper.
What they actually do.
- Morning standup with the IAM team — review what JML events fired overnight, what failed, what needs triage
- Configure or troubleshoot a SAML / OIDC integration for a new SaaS app onboarding
- Investigate a help-desk ticket where a user can't sign in to a specific app
- Implement a new Conditional Access / sign-on policy approved by the security team
- Build or adjust a Lifecycle Management rule that provisions / deprovisions an app
- Pair with the SOC on an anomalous sign-in alert
- Document changes for the next access certification cycle
What you need to do the job.
Identity protocols
OAuth 2.1, OpenID Connect, SAML 2.0 at a working level. You don't need to write the spec, but you need to debug them when something breaks.
At least one major IdP
Deep familiarity with one of Okta, Entra ID, JumpCloud, Auth0, Ping. Certifications help but practical experience matters more.
SCIM provisioning
How to configure SCIM, debug failed provisions, map attributes between systems.
Scripting + light automation
PowerShell or Python for one-off scripts, plus comfort with the IdP's Workflow / Automate UI for production-grade automation.
Directory fundamentals
AD / LDAP concepts, even if you don't admin them. Most enterprises still have AD somewhere in the picture.
Nice to have
- Terraform / Infrastructure-as-code for the IdP tenant
- Familiarity with HRIS (Workday / SuccessFactors / BambooHR) as the authoritative source
- Light experience with SailPoint or Saviynt for governance-adjacent work
- One scripting language at automation depth (Python preferred)
Certs that move the needle.
Okta Certified Administrator
Okta
The IdP-side cert that gets resumes past the screen. Practical exam.
Microsoft SC-300 (Identity & Access Administrator)
Microsoft
Entra ID equivalent. Free training, exam fee is modest.
CIDPRO (Certified Identity Professional)
IDPro
Vendor-neutral certification. Carries weight at enterprises that buy off the IdPro Body of Knowledge.
- Service Desk + identity-adjacent ticket triage
- Cybersecurity engineer with identity-leaning skills
- SaaS administrator (e.g. Salesforce admin) wanting to specialize
- Identity Architect (next step for senior IAM engineers)
- PAM Engineer (specialization)
- IAM Program Manager (move to program / management track)
- Your IdP admin console is a bottleneck — security team can't keep up with app onboardings
- JML automation is fragile or manual
- You're running >50 SaaS integrations and they're drifting out of compliance
- A compliance program (SOC 2, FedRAMP, HIPAA) is forcing structured IAM evidence
- Generic "I know AD" without IdP-specific depth on at least one platform
- No working OAuth / OIDC mental model — can't explain the difference
- Heavy reliance on a single vendor's GUI without scripting or automation chops
- Treats IAM as security gatekeeping rather than enablement