Identity Architect — what the role actually does
The strategic role that designs identity at the program level — IdP selection, capability roadmap, multi-year transformation arcs.
TL;DR
Senior architect-level role. Usually 8-12+ years of IAM experience. Sits in design + decision-making, not day-to-day operations. Outputs are reference architectures, technology selections, multi-year roadmaps, executive narratives. Pairs with CISO + enterprise architecture.
What they actually do.
- Lead architecture review for a major migration (Okta → Entra, SailPoint → Saviynt, etc.)
- Author the IAM section of a 3-year security roadmap
- Run a vendor bake-off for a PAM or IGA decision
- Brief the CISO + leadership on a critical IAM risk
- Review the engineering team's implementation against the design
- Coordinate with adjacent architects (network, security, app, data) on IAM-adjacent decisions
- Mentor IAM engineers; lead a community-of-practice session
What you need to do the job.
Multi-vendor depth
Working knowledge of at least 2-3 major IAM platform classes (workforce IdP, PAM, IGA, CIAM). Doesn't need to admin them but must know capabilities + trade-offs.
Reference architecture skill
Can produce + defend architecture diagrams. Understands ADRs (Architecture Decision Records). Documents in a way auditors + engineers can both consume.
Standards mastery
Deep knowledge of OAuth 2.1, OIDC, SAML 2.0, SCIM 2.0, FIDO2. Can read the RFCs + recognize when an implementation diverges.
Vendor negotiation
Can sit across from vendor sales + technical staff and shape the contract structure. Knows the SKU games + the per-MAU vs per-user pricing levers.
Communication
Equally effective with the CISO, the IAM engineer, and the application owner. Different audiences, different framing, same architecture.
Nice to have
- Threat modeling experience (STRIDE / PASTA / similar)
- Zero Trust architecture exposure
- Cloud platform certs (AWS / Azure / GCP) at the architect tier
- Familiarity with regulatory frameworks (NIST 800-53, ISO 27001, HIPAA, FFIEC, FedRAMP)
Certs that move the needle.
CIDPRO (Certified Identity Professional)
IDPro
The vendor-neutral architect cert. Higher signal than vendor certs for this role.
CISSP
(ISC)²
Broader security architecture; required for many enterprise + government roles.
SABSA Foundation (or higher)
SABSA
Business-driven security architecture framework that maps to IAM nicely.
- Senior or Staff IAM Engineer with breadth across multiple platforms
- Solution Architect with security focus
- Enterprise Architect specializing in identity
- IAM Director / VP Identity (management track)
- Field CTO / pre-sales engineering (vendor side)
- Consulting practice lead
- You're evaluating an IdP migration and want vendor-neutral guidance
- You're designing a multi-year IAM modernization program
- You have IAM engineers but no central design authority
- Identity touches 2+ of: workforce, customer, privileged, machine — and needs cross-cutting strategy
- Pure vendor-loyalist (won't recommend non-incumbent solutions)
- No hands-on memory — can't describe what they actually configured 3 years ago
- Architecture diagrams without operational consideration
- Doesn't understand the business / cost dimension of identity