Career roadmap
Identity & Access Engineer
Own who can access what, everywhere, and make joining, moving and leaving happen automatically.
Before you start IAM
- Directory services and authentication basics
- Understanding of web protocols
- Scripting ability
Identity protocols
The protocol layer is the technical core of the role and the bulk of the interview.
Factors, assurance levels, and what each actually protects against.
- Authentication factors and assurance
- Phishing-resistant MFA and FIDO2
- Passwordless and passkeys
- Credential stuffing defences
The most-asked protocol topic in identity interviews, and the most often confused.
- Authorization code flow with PKCE
- Tokens: access, ID, refresh
- Scopes, audiences and claims
- Common implementation mistakes
Still everywhere in enterprise, and still generating incidents.
- SAML assertions and bindings
- Metadata and certificate rotation
- Signature validation pitfalls
- SAML versus OIDC decision
Active Directory and its cloud successors remain the source of truth.
- Active Directory structure and trusts
- Entra ID and hybrid sync
- LDAP and Kerberos
- Directory as source of truth
Where identity systems leak: tokens that live too long or cannot be revoked.
- Session lifetime and idle timeout
- Refresh token rotation and reuse detection
- Revocation and logout propagation
- Continuous access evaluation
BuildImplement SSO into a test application using both SAML and OIDC, and document the flows.
Access governance
Not just who can log in, but what they can do and whether they still should.
RBAC, ABAC and ReBAC, and the failure mode of each at scale.
- RBAC and role explosion
- ABAC and policy complexity
- Relationship-based access control
- Choosing a model for a given estate
Orphaned accounts and accumulated access are the standard audit findings.
- Automated provisioning with SCIM
- Role change and access recalculation
- Timely deprovisioning
- Contractor and third-party identity
A compliance requirement that is usually done badly and manually.
- Review campaigns and scoping
- Reviewer fatigue and rubber-stamping
- Risk-based review frequency
- Evidence for auditors
Standing admin access is the finding on nearly every enterprise assessment.
- Just-in-time elevation
- Session recording and vaulting
- Tiered administration model
- Break-glass procedures
Non-human identities now outnumber human ones, and are governed far worse.
- Service accounts and their sprawl
- Workload identity federation
- Secret-free authentication
- Ownership and lifecycle for machine identity
BuildDesign a role model for a real organisation and run an access review against it.
Zero trust and conditional access
Access decisions based on context rather than network location.
The architecture that identity teams are usually asked to lead.
- Never trust, always verify in practice
- Policy decision and enforcement points
- Removing network-based trust
- Phased migration approach
The practical implementation of contextual access decisions.
- Policy design and precedence
- Device compliance signals
- Location and impossible travel
- Avoiding lockout scenarios
Step-up authentication when the signals justify friction.
- Risk signals and scoring
- Step-up challenge design
- Balancing security and usability
- Tuning false positives
A distinct discipline with scale, privacy and conversion pressures.
- Registration and progressive profiling
- Social login and account linking
- Account recovery security
- Consent and privacy requirements
Partner and supplier access is a large, often ungoverned attack surface.
- Guest identity lifecycle
- Cross-tenant access policy
- External sharing controls
- Third-party risk in identity
BuildImplement conditional access policies with device posture and risk-based step-up authentication.
Operating identity systems
Identity is a tier-zero service. If it is down, everything is down.
An identity provider outage is a total outage. Design accordingly.
- Redundancy and failover for identity
- Break-glass account design and testing
- Certificate expiry as an outage cause
- Dependency mapping
Identity logs are the highest-value detection source in most estates.
- Sign-in log analysis
- Detecting MFA fatigue attacks
- Privilege change alerting
- Anomalous consent grants
Identity work is mostly integration work, and mostly automatable.
- SCIM provisioning connectors
- Identity APIs and scripting
- Policy as code for access
- Testing identity changes safely
Most identity roles involve moving from one provider to another.
- Application migration inventory
- Coexistence during migration
- User communication and cutover
- Rollback planning
Identity controls are the ones auditors examine first.
- Segregation of duties
- Evidence for access controls
- Regulatory requirements by industry
- Audit finding remediation
BuildDocument and test an identity outage recovery plan, including break-glass access.
Interview preparation
Identity interviews go deep on protocols and on lifecycle design.
Draw the OIDC flow on a whiteboard. This gets asked almost every time.
- Authorization code flow step by step
- Why PKCE exists
- Token validation requirements
- SAML assertion validation
Design access management for an organisation with mixed estate and contractors.
- Role model design
- Lifecycle automation architecture
- Privileged access approach
- Migration phasing
SSO is broken for one application. Diagnose it.
- Reading SAML and OIDC traces
- Clock skew and certificate issues
- Claim mapping mismatches
- Conditional access blocking unexpectedly
Identity attacks are specific and well documented. Know them.
- Token theft and replay
- Consent phishing
- MFA bypass techniques
- Golden ticket and directory attacks
Identity changes affect everyone, which makes stakeholder management central.
- Rolling out MFA against resistance
- An access change that broke a business process
- Balancing security with usability
- Working with auditors
BuildA working SSO integration demo with documentation of every flow and failure mode.
IAM tools on your CV
- Entra ID / Okta
- Active Directory
- SCIM
- OAuth 2.1 / OIDC
- SAML
- Keycloak
- PAM tooling
- PowerShell
What IAM employers ask to see
- A working SSO integration with documented flows
- An automated joiner/mover/leaver implementation
- A role model and access review campaign design
- A tested break-glass and identity outage plan
Every zero trust programme is an identity programme underneath. Specialised, in demand, and unusually stable because identity systems are never finished.
Content last reviewed 2026-08-31. Guidance only — no institute or paid placement is endorsed anywhere in this book.