Skip to main content
POST ATLAS
RoleCybersecurity

IAM Engineer

Identity lifecycle, SSO, federation, conditional access, the unsung gate.

The verdict

Quietly one of the best-paid and least-glamorous seats in security. Take it if you can stomach the work, the ceiling is unusually high.

Pick this if
  • You're patient with directory plumbing and authentication flows
  • You like problems where the answer is correct or it isn't
  • You can hold an identity model across cloud, SaaS and on-prem in one head
  • You're happy being the team that other teams complain about until they need you
Skip this if
  • You can't bear long change-control cycles
  • You want public credit, IAM is mostly invisible when it works
  • You don't enjoy reading specs, half the job is RFCs and vendor docs
What "doing well" looks like in the seat
  • Your access reviews actually catch things
  • Engineering teams stop asking for break-glass admin
  • You can design a joiner-mover-leaver flow that survives reorgs
  • Auditors stop asking you the same questions year on year
The bit you're probably underestimating

IAM teams in the UK are often understaffed and chronically underfunded until something goes wrong. You'll inherit ten years of legacy entitlements, three identity stores nobody documented, and a leadership team who'll only fund the work after the breach. If you can survive the first eighteen months without being ground down, the compounding effect on your career is extraordinary. If you can't, this is one of the fastest paths to burnout in security.

Tradeoffs at a glance

Hover any chip for the calibrated meaning. Ratings are directional, not absolute.

Promotion ceiling

High. IAM architect is consistently in demand.

Who actually gets in
  • +Sysadmin (AD-heavy)
  • +Cloud Engineer
  • +Security Engineer
Common misconceptions
  • −That it's 'just provisioning', identity is the new perimeter.

Where this leads

  • Cloud Security
  • Zero Trust Architect
  • PKI Engineer

Certifications people pair with this

Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.

Tech you'll see

  • Active Directory

Pathways that pass through here

Where this fits

Roles connect to pathways, certs and other roles. Use one to test the next.

Pathways that touch this
Roles to consider
Perspectives that bear on this

The serious next step

You've read about the role. The harder question is whether it's the right one for you.

A Career Verdict is the written, practitioner-authored call on your specific route into and out of this role. Six primitives, same format every time.

Plateau zone
The flat year nobody warns you about, named and timed.
Reality vs Fantasy
Your actual five-year curve against the one you've been sold.
What to sit and what to skip
Each cert on your list: useful, optional, or skip, with reasons.
The call
A single written judgment on whether your plan holds up.
Tradeoff spectrum
What you're giving up for what you're choosing, plotted.
Decisive factors
The two or three things that will actually make or break this.
See what a Career Verdict looks like£25 · one verdict, yours to keep

Built on POST's practitioner-authored assessment framework, calibrated by James from twenty years across helpdesk, infrastructure and security. Framework is human-authored; the verdict applies it to your inputs.

All roles