01Identity Fundamentals & Directory Services
- IAM Analyst
- 2
- IAM Engineer
- 3
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 3.5
1.1Identity lifecycle (joiner / mover / leaver)
Explains end-to-end JML flows, authoritative sources, and HR-driven provisioning; understands where lifecycle gaps create risk.
1.2Active Directory
OU design, GPOs, trusts, replication, delegation of admin; knows common AD hygiene and hardening basics.
1.3Entra ID & cloud directories
Hybrid identity and sync (Entra Connect / cloud sync), object types, app registrations vs. enterprise applications, admin units.
1.4LDAP fundamentals
Directory trees, binds, search filters, and common LDAP integration patterns and pitfalls.
1.5Identity data quality & correlation
Authoritative source design, account correlation and matching, finding and remediating orphaned accounts at scale.
02Authentication & Credentials
- IAM Analyst
- 2
- IAM Engineer
- 3
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4
2.1MFA & phishing resistance
Compares factor types honestly; understands FIDO2 / WebAuthn / passkeys and why OTP and push are phishable.
2.2Passwordless strategy
Knows rollout sequencing, coexistence with legacy auth, and how recovery and fallback flows can undermine the whole design.
2.3Windows authentication internals
Kerberos ticket flow, NTLM weaknesses, and practical paths to retiring legacy authentication.
2.4Adaptive & risk-based authentication
Designs conditional access with device, location, and risk signals; knows when to require step-up vs. block.
2.5Credential policy & NIST 800-63B
Applies modern guidance on password composition, rotation, breach screening, and secure account recovery.
03Federation & Identity Standards
- IAM Analyst
- 1.5
- IAM Engineer
- 3
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4.5
3.1SAML 2.0
SP vs. IdP roles, assertions, bindings, certificate rotation; can troubleshoot real integration failures.
3.2OAuth 2.0
Grant types and when each applies, PKCE, token lifetimes, and common implementation mistakes.
3.3OpenID Connect
ID token vs. access token, flows, claims, discovery, and how OIDC layers on OAuth.
3.4Token security
JWT validation pitfalls (audience, issuer, algorithm), replay and theft mitigations, sender-constrained tokens.
3.5SCIM & provisioning integrations
SCIM schema and patch operations, connector patterns, and handling apps with poor or no provisioning APIs.
04Authorization & Access Models
- IAM Analyst
- 1.5
- IAM Engineer
- 2.5
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4
4.1RBAC design & role engineering
Role mining, granularity trade-offs, and keeping role models maintainable instead of exploding into one-off roles.
4.2ABAC / PBAC & policy engines
Attribute- and policy-based control, policy-as-code (OPA, Cedar), and when they beat static roles.
4.3Least privilege & separation of duties
Designs and enforces SoD; can spot toxic combinations and knows how to remediate them.
4.4Entitlement management
Access catalogs, request and approval design, time-bound access, and avoiding rubber-stamp approvals.
05Identity Governance & Administration
- IAM Analyst
- 1.5
- IAM Engineer
- 2.5
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4
5.1Provisioning automation
Birthright vs. requestable access, connector design, event-driven vs. scheduled provisioning.
5.2Access certifications
Campaign design, reviewer selection, micro-certifications, and concrete tactics against certification fatigue.
5.3SoD & policy violation handling
Detection, remediation workflows, and compensating controls when a violation can't simply be removed.
5.4IGA platform depth
Hands-on implementation experience with SailPoint, Saviynt, or similar: connectors, workflows, upgrades, debugging.
5.5Identity analytics
Outlier and peer-group analysis, access risk scoring, and using data to drive cleanup.
06Privileged Access Management
- IAM Analyst
- 1
- IAM Engineer
- 2.5
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4
6.1Vaulting & credential rotation
Account onboarding, rotation strategies, service account handling, and safe break-glass design.
6.2Privileged session management
Session proxying, recording, and isolation; understands what each control actually prevents.
6.3Just-in-time & zero standing privilege
Elevation workflows, ephemeral accounts, and migrating teams off permanent admin rights.
6.4Secrets management
Application secrets, HashiCorp Vault or cloud-native stores, and the secret-zero bootstrapping problem.
6.5PAM platform experience
Deployment and operations depth with CyberArk, Delinea, BeyondTrust, or similar.
07Cloud & Workload Identity
- IAM Analyst
- 1
- IAM Engineer
- 3
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4.5
7.1AWS IAM
Policy evaluation logic, roles and trust policies, permission boundaries, SCPs, and cross-account patterns.
7.2Azure & GCP identity
Entra directory roles vs. Azure RBAC, PIM, managed identities; GCP service accounts and IAM bindings.
7.3Workload & machine identity
Service accounts, managed identities, workload identity federation, SPIFFE, and killing long-lived credentials.
7.4Kubernetes identity
K8s RBAC, service account tokens, and OIDC federation from clusters to cloud providers.
7.5CIEM & entitlement sprawl
Finding unused and toxic cloud permissions across providers and shrinking them without outages.
08Zero Trust & Modern Identity Architecture
- IAM Analyst
- 1
- IAM Engineer
- 2
- Senior IAM Engineer / Lead
- 3
- IAM Architect / Principal
- 4.5
8.1Zero trust identity principles
Identity as the control plane: policy enforcement points, continuous verification, and what changes in design.
8.2Continuous access evaluation
CAE / CAEP, shared signals, and revoking sessions mid-lifetime rather than at next login.
8.3Device trust integration
Bringing device compliance and health signals into access decisions; handling BYOD sanely.
8.4Non-human & AI agent identity
Governing bots, service principals, and AI agents: scoped credentials, delegation, and auditability.
09Identity Threats & Security Operations
- IAM Analyst
- 1.5
- IAM Engineer
- 2.5
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4
9.1Identity attack techniques
Kerberoasting, pass-the-hash, golden/silver tickets, token theft, MFA fatigue, adversary-in-the-middle phishing.
9.2Detection & ITDR
Signals of identity compromise, useful log sources, and identity threat detection and response tooling.
9.3AD hardening & tiering
Admin tier model, protected accounts, attack path management, and what breaks when tiering is skipped.
9.4Identity incident response
Containment for compromised accounts and stolen tokens; sequencing actions without tipping off the attacker.
10Compliance, Risk & Audit
- IAM Analyst
- 1.5
- IAM Engineer
- 2
- Senior IAM Engineer / Lead
- 3
- IAM Architect / Principal
- 3.5
10.1Regulatory drivers
What SOX, GDPR, HIPAA, and PCI DSS actually require from access management, beyond buzzwords.
10.2Frameworks in practice
Applying NIST 800-63, ISO 27001, and CIS controls to real programs rather than reciting them.
10.3Audit support & evidence
Producing access review artifacts, point-in-time answers, and closing findings for good.
10.4Access risk management
Risk scoring access, running an exception process with teeth, and designing compensating controls.
11Automation & Engineering
- IAM Analyst
- 1.5
- IAM Engineer
- 3
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 3.5
11.1Scripting for identity
PowerShell / Python for identity tasks with idempotence, dry-run modes, and safety rails.
11.2APIs & integration
Microsoft Graph and REST APIs, throttling, pagination, webhooks, and event-driven identity.
11.3Identity as code
Managing IAM policy and configuration in Terraform or similar; drift detection and review workflows.
11.4Troubleshooting method
Systematic diagnosis of auth failures across layers: logs, traces, tokens, network, clock skew.
12Communication & Professional Skills
- IAM Analyst
- 2
- IAM Engineer
- 2.5
- Senior IAM Engineer / Lead
- 3.5
- IAM Architect / Principal
- 4.5
12.1Stakeholder communication
Translates identity risk and controls into language executives and business owners act on.
12.2Documentation & runbooks
Writes operational docs people actually use under pressure.
12.3Delivery & vendor management
Drives rollouts and migrations to completion; evaluates vendors on substance.
12.4Judgment & prioritization
Balances security against friction; knows when and how to relax a control safely.
13Customer IAM (CIAM)
- IAM Analyst
- 1
- IAM Engineer
- 2
- Senior IAM Engineer / Lead
- 3
- IAM Architect / Principal
- 3.5
13.1CIAM architecture
Registration, progressive profiling, social login, and account recovery designed for millions of external users.
13.2Consent & privacy
Consent capture and lifecycle, preference centers, and data subject rights in identity flows.
13.3Fraud & bot defense
Credential stuffing, bot mitigation, risk signals at registration and login.
13.4Scale & user experience
Performance at scale and spending a friction budget wisely against conversion impact.
IAM Skills Scoring Matrix v1.0.0 · Identity Lab, jamalsjones.com. Targets are the bar each level is expected to clear in that domain, out of 5.