Identity and access management architects and consultants

IAM architects assess identity stores and access dependencies before defining the target architecture. They identify excessive permissions and ownership gaps, then translate business responsibilities into role-based access controls and segregation-of-duties rules.

Identity governance and administration (IGA) consultants configure joiner-mover-leaver workflows and access certification campaigns in platforms such as SailPoint or Saviynt. Their work covers approval routing and entitlement mapping, with review evidence that supports internal controls. Bring them in when access decisions depend on spreadsheets or account removal cannot be verified.

IAM engineers integrate business applications with Microsoft Entra ID or Okta, replacing separate login configurations with centrally maintained authentication policies. They configure federation through SAML or OpenID Connect and validate OAuth 2.0 authorization flows where applications expose APIs.

• Workforce authentication: Configure multifactor authentication and conditional access, including exception handling for legacy applications.
• Customer identity: Implement registration and account recovery flows in customer identity and access management (CIAM) platforms. Validate authentication changes against application requirements before release.

Privileged access management (PAM) specialists identify administrator accounts and service credentials that sit outside existing controls. Using platforms such as CyberArk or BeyondTrust, they configure credential vaulting and rotation, then connect privileged access workflows to approval policies.

Work can include time-limited elevation and privileged session recording. Specialists also define emergency access procedures and test credential changes against dependent services. This expertise is relevant when shared accounts prevent individual accountability or long-lived credentials remain embedded in scripts and scheduled tasks.

IAM integration engineers connect HR systems and application directories through SCIM or platform APIs. They implement provisioning logic and reconcile account states so failed updates can be traced to their source.

• Incident investigation: Diagnose federation failures and provisioning errors using identity-provider logs and application traces. Correct configuration defects and document recovery steps.
• Platform changes: Support identity-provider migrations and directory consolidation. Validate attribute mappings and authentication behaviour before cutover, with rollback procedures for affected integrations.