IAM Specialist
When to Use
- Design workforce and machine identity lifecycle — joiner/mover/leaver, contractors, service principals
- Model RBAC, ABAC, or PBAC entitlements, roles, and permission sets with least privilege
- Run access reviews and recertification — campaigns, risk-based sampling, manager attestation
- Architect SSO federation — SAML, OIDC, SCIM provisioning, app onboarding patterns
- Implement privileged access — PAM vaulting, JIT elevation, session recording, break-glass policy
- Author cloud IAM roles, policies, permission boundaries, trust relationships (AWS/GCP/Azure)
- Govern service accounts and secrets — naming, rotation, no human keys, workload identity
- Define separation of duties matrices and toxic-combination detection
- Align IAM controls to audit and risk narratives (with GRC partners)
When NOT to Use
- Multi-BU landing zone, CCoE, EA, or executive cloud governance →
enterprise-cloud-architect
- Org SCPs, CSPM, network segmentation, KMS program, detective controls →
cloud-security-engineer
- Access ticket fulfillment, key rotation runbooks, patching, restores →
cloud-system-administrator
- VPC/RDS/serverless build without IAM as primary deliverable →
cloud-engineer
- SIEM/EDR deployment, WAF, broad security tooling →
information-security-engineer
- SOC 2 evidence pipelines and automated control checks →
compliance-engineer
- CI OIDC and pipeline scan gates only →
devsecops
- Inherent/residual risk scoring and risk register →
security-risk-analyst
- Authorized exploitation or pentest validation →
penetration-tester
- Legal interpretation, employment policy, or contract redlines →
commercial-counsel
Related skills
| Need |
Skill |
| Cloud org guardrails, CSPM, network/KMS security |
cloud-security-engineer |
| Cloud resource build and workload identity wiring |
cloud-engineer |
| Day-2 IAM tickets, rotation, break-glass execution |
cloud-system-administrator |
| Enterprise landing zone and CCoE governance |
enterprise-cloud-architect |
| SIEM, EDR, encryption, security-as-code guardrails |
information-security-engineer |
| GRC program, framework scope, audit coordination |
compliance-specialist |
| Audit evidence automation from IdP and cloud APIs |
compliance-engineer |
| CI/CD OIDC federation and pipeline least privilege |
devsecops |
| Risk register, treatment, and executive heat maps |
security-risk-analyst |
| Cloud framework evidence and residency packages |
cloud-compliance-specialist |
| Security program strategy |
cybersecurity |
Core Workflows
1. Scope and governance model
Identity domains, RACI, and boundaries vs cloud security and ops.
See references/iam_specialist_scope.md.
2. Identity lifecycle and access governance
Joiner/mover/leaver, provisioning, reviews, and exceptions.
See references/identity_lifecycle_and_governance.md.
3. Entitlements and authorization models
RBAC/ABAC/PBAC design, role engineering, and SoD.
See references/rbac_abac_and_entitlements.md.
4. Federation and SSO protocols
SAML, OIDC, SCIM, and SaaS onboarding.
See references/federation_sso_and_protocols.md.
5. Privileged access and PAM
JIT, vaulting, break-glass, and session controls.
See references/privileged_access_and_pam.md.
6. Cloud IAM and least privilege
Cross-cloud IAM patterns, policy review, and machine identity.
See references/cloud_iam_and_least_privilege.md.
Outputs
- Entitlement catalog — roles, permissions, owners, review cadence
- Access review campaign — scope, attestations, remediation tracker
- Federation design — trust, claims, MFA, provisioning flow
- PAM policy — elevation paths, approval, monitoring, break-glass
- Cloud IAM policy set — least-privilege JSON with trust boundaries documented
- SoD matrix — incompatible duties, compensating controls, exceptions
- Service account standards — creation, rotation, audit queries
Principles
- Identity is the perimeter — authenticate strongly; authorize minimally
- No standing privilege — prefer JIT and time-bound elevation for admin
- Prove every grant — reviews, logs, and SoD checks on sensitive entitlements
- Humans ≠ machines — separate lifecycle, credentials, and audit trails
- Federation fails closed — misconfigured trust denies access; monitor sync errors
- Break-glass is rare, logged, and reviewed — not a daily admin shortcut
1---2name: iam-specialist3description: Guides identity and access management—workforce and machine identity lifecycle, RBAC/ABAC/PBAC entitlement design, access reviews and recertification, SSO/SAML/OIDC federation, privileged access (PAM/JIT), cloud IAM least privilege (AWS/GCP/Azure concepts), service accounts and secrets hygiene, and separation of duties. Use for IAM, identity governance, access review, RBAC, least privilege, SSO federation, PAM, privileged access, cloud IAM policy, service account, or SoD—not full cloud landing zone architecture (enterprise-cloud-architect), broad cloud security controls (cloud-security-engineer), day-2 break-glass ticket execution only (cloud-system-administrator), pentest (penetration-tester), or legal/HR policy drafting only.4---56# IAM Specialist78## When to Use910- Design **workforce and machine identity lifecycle** — joiner/mover/leaver, contractors, service principals11- Model **RBAC, ABAC, or PBAC** entitlements, roles, and permission sets with least privilege12- Run **access reviews and recertification** — campaigns, risk-based sampling, manager attestation13- Architect **SSO federation** — SAML, OIDC, SCIM provisioning, app onboarding patterns14- Implement **privileged access** — PAM vaulting, JIT elevation, session recording, break-glass policy15- Author **cloud IAM** roles, policies, permission boundaries, trust relationships (AWS/GCP/Azure)16- Govern **service accounts and secrets** — naming, rotation, no human keys, workload identity17- Define **separation of duties** matrices and toxic-combination detection18- Align IAM controls to **audit and risk** narratives (with GRC partners)1920## When NOT to Use2122- Multi-BU landing zone, CCoE, EA, or executive cloud governance → `enterprise-cloud-architect`23- Org SCPs, CSPM, network segmentation, KMS program, detective controls → `cloud-security-engineer`24- Access ticket fulfillment, key rotation runbooks, patching, restores → `cloud-system-administrator`25- VPC/RDS/serverless build without IAM as primary deliverable → `cloud-engineer`26- SIEM/EDR deployment, WAF, broad security tooling → `information-security-engineer`27- SOC 2 evidence pipelines and automated control checks → `compliance-engineer`28- CI OIDC and pipeline scan gates only → `devsecops`29- Inherent/residual risk scoring and risk register → `security-risk-analyst`30- Authorized exploitation or pentest validation → `penetration-tester`31- Legal interpretation, employment policy, or contract redlines → `commercial-counsel`3233## Related skills3435| Need | Skill |36|---|---|37| Cloud org guardrails, CSPM, network/KMS security | `cloud-security-engineer` |38| Cloud resource build and workload identity wiring | `cloud-engineer` |39| Day-2 IAM tickets, rotation, break-glass execution | `cloud-system-administrator` |40| Enterprise landing zone and CCoE governance | `enterprise-cloud-architect` |41| SIEM, EDR, encryption, security-as-code guardrails | `information-security-engineer` |42| GRC program, framework scope, audit coordination | `compliance-specialist` |43| Audit evidence automation from IdP and cloud APIs | `compliance-engineer` |44| CI/CD OIDC federation and pipeline least privilege | `devsecops` |45| Risk register, treatment, and executive heat maps | `security-risk-analyst` |46| Cloud framework evidence and residency packages | `cloud-compliance-specialist` |47| Security program strategy | `cybersecurity` |4849## Core Workflows5051### 1. Scope and governance model5253Identity domains, RACI, and boundaries vs cloud security and ops.5455**See `references/iam_specialist_scope.md`.**5657### 2. Identity lifecycle and access governance5859Joiner/mover/leaver, provisioning, reviews, and exceptions.6061**See `references/identity_lifecycle_and_governance.md`.**6263### 3. Entitlements and authorization models6465RBAC/ABAC/PBAC design, role engineering, and SoD.6667**See `references/rbac_abac_and_entitlements.md`.**6869### 4. Federation and SSO protocols7071SAML, OIDC, SCIM, and SaaS onboarding.7273**See `references/federation_sso_and_protocols.md`.**7475### 5. Privileged access and PAM7677JIT, vaulting, break-glass, and session controls.7879**See `references/privileged_access_and_pam.md`.**8081### 6. Cloud IAM and least privilege8283Cross-cloud IAM patterns, policy review, and machine identity.8485**See `references/cloud_iam_and_least_privilege.md`.**8687## Outputs8889- **Entitlement catalog** — roles, permissions, owners, review cadence90- **Access review campaign** — scope, attestations, remediation tracker91- **Federation design** — trust, claims, MFA, provisioning flow92- **PAM policy** — elevation paths, approval, monitoring, break-glass93- **Cloud IAM policy set** — least-privilege JSON with trust boundaries documented94- **SoD matrix** — incompatible duties, compensating controls, exceptions95- **Service account standards** — creation, rotation, audit queries9697## Principles9899- **Identity is the perimeter** — authenticate strongly; authorize minimally100- **No standing privilege** — prefer JIT and time-bound elevation for admin101- **Prove every grant** — reviews, logs, and SoD checks on sensitive entitlements102- **Humans ≠ machines** — separate lifecycle, credentials, and audit trails103- **Federation fails closed** — misconfigured trust denies access; monitor sync errors104- **Break-glass is rare, logged, and reviewed** — not a daily admin shortcut
daemon-blockint-tech