Identity Security (IAM, PAM, SSO)
Engineer the identity layer. Entra ID, Okta, CyberArk, PAM, SSO, MFA, Zero Trust. Operational, technical, in demand.
One of the better-paid lanes nobody talks about. Specialist, operational, deeply in demand, and unlikely to be replaced by anything for a long while.
You like operational depth, you don't mind being the person every other team needs at the worst moments, and you can hold complex access models in your head without flinching.
You're looking for variety. Identity is a deep lane, not a wide one, and the work doesn't change as fast as the rest of security.
Phased progression
Foundations → first role → specialisation → advanced. The realistic order, not a script.
- 010–6 monthsFoundations
Literacy, lab habits, the cert that opens first conversations.
Microsoft SC-300 - 026–18 monthsFirst paid role
Land a IAM Engineer. Operational time, not more certs, earns the next move.
IAM Engineer£45–65k IAM eng - 031.5–3 yearsSpecialisation
Add a specialist credential aligned to the work you're already doing.
Okta Professional£75–105k senior - 043+ yearsAdvanced
Move into adjacent roles. Long-term credentials become worth their cost.
Identity EngineerMicrosoft SC-100£110–140k identity architect (UK)
- 01Foundations0–6 months
Literacy, lab habits, the cert that opens first conversations.
Microsoft SC-300 - 02First paid role6–18 months
Land a IAM Engineer. Operational time, not more certs, earns the next move.
IAM Engineer£45–65k IAM eng - 03Specialisation1.5–3 years
Add a specialist credential aligned to the work you're already doing.
Okta Professional£75–105k senior - 04Advanced3+ years
Move into adjacent roles. Long-term credentials become worth their cost.
Identity EngineerMicrosoft SC-100£110–140k identity architect (UK)
Certification sequence
Ordered by realistic relevance, not vendor marketing.
Practical projects
What to actually build, the portfolio that opens interviews.
- Build an access-review workflow against Entra ID
- Implement PAM for a tier-0 service
- Design an SSO / Conditional Access policy set
- ·AD / M365 admin → IAM
- ·Cloud engineer → cloud IAM
Realistic expectations
What no recruiter will tell you.
That it's just SSO setup. Modern identity work is policy engines, workload identity, PAM workflows and incident response when someone phishes a privileged account. It's a discipline, not a project.
Twelve to twenty-four months to a dedicated IAM engineering role if you're coming from sysadmin or cloud. Faster inside Microsoft-heavy shops where Entra work is already on your plate.
Where this fits
A pathway is a sequence, not a destination. Here are the roles and certs along it.
The next step
The pathway is plausible. Whether it holds for five years is a different question.
A Career Verdict applies the framework to your actual stage and stack: what holds, what breaks, what would change the call.
A route shows what people usually do. A Career Verdict judges whether it's realistic for you.
A Career Verdict includes
Built on POST's practitioner-authored assessment framework, calibrated by James from twenty years across helpdesk, infrastructure and security. Framework is human-authored; the verdict applies it to your inputs.