IAM Specialist

When to Use

• Design workforce and machine identity lifecycle — joiner/mover/leaver, contractors, service principals
• Model RBAC, ABAC, or PBAC entitlements, roles, and permission sets with least privilege
• Run access reviews and recertification — campaigns, risk-based sampling, manager attestation
• Architect SSO federation — SAML, OIDC, SCIM provisioning, app onboarding patterns
• Implement privileged access — PAM vaulting, JIT elevation, session recording, break-glass policy
• Author cloud IAM roles, policies, permission boundaries, trust relationships (AWS/GCP/Azure)
• Govern service accounts and secrets — naming, rotation, no human keys, workload identity
• Define separation of duties matrices and toxic-combination detection
• Align IAM controls to audit and risk narratives (with GRC partners)

When NOT to Use

• Multi-BU landing zone, CCoE, EA, or executive cloud governance → enterprise-cloud-architect
• Org SCPs, CSPM, network segmentation, KMS program, detective controls → cloud-security-engineer
• Access ticket fulfillment, key rotation runbooks, patching, restores → cloud-system-administrator
• VPC/RDS/serverless build without IAM as primary deliverable → cloud-engineer
• SIEM/EDR deployment, WAF, broad security tooling → information-security-engineer
• SOC 2 evidence pipelines and automated control checks → compliance-engineer
• CI OIDC and pipeline scan gates only → devsecops
• Inherent/residual risk scoring and risk register → security-risk-analyst
• Authorized exploitation or pentest validation → penetration-tester
• Legal interpretation, employment policy, or contract redlines → commercial-counsel

Related skills

Core Workflows

1. Scope and governance model

Identity domains, RACI, and boundaries vs cloud security and ops.

See references/iamspecialistscope.md.

2. Identity lifecycle and access governance

Joiner/mover/leaver, provisioning, reviews, and exceptions.

See references/identitylifecycleand_governance.md.

3. Entitlements and authorization models

RBAC/ABAC/PBAC design, role engineering, and SoD.

See references/rbacabacand_entitlements.md.

4. Federation and SSO protocols

SAML, OIDC, SCIM, and SaaS onboarding.

See references/federationssoand_protocols.md.

5. Privileged access and PAM

JIT, vaulting, break-glass, and session controls.

See references/privilegedaccessand_pam.md.

6. Cloud IAM and least privilege

Cross-cloud IAM patterns, policy review, and machine identity.

See references/cloudiamandleastprivilege.md.

Outputs

• Entitlement catalog — roles, permissions, owners, review cadence
• Access review campaign — scope, attestations, remediation tracker
• Federation design — trust, claims, MFA, provisioning flow
• PAM policy — elevation paths, approval, monitoring, break-glass
• Cloud IAM policy set — least-privilege JSON with trust boundaries documented
• SoD matrix — incompatible duties, compensating controls, exceptions
• Service account standards — creation, rotation, audit queries

Principles

• Identity is the perimeter — authenticate strongly; authorize minimally
• No standing privilege — prefer JIT and time-bound elevation for admin
• Prove every grant — reviews, logs, and SoD checks on sensitive entitlements
• Humans ≠ machines — separate lifecycle, credentials, and audit trails
• Federation fails closed — misconfigured trust denies access; monitor sync errors
• Break-glass is rare, logged, and reviewed — not a daily admin shortcut