IAM Specialist

When to Use

Design workforce and machine identity lifecycle — joiner/mover/leaver, contractors, service principals
Model RBAC, ABAC, or PBAC entitlements, roles, and permission sets with least privilege
Run access reviews and recertification — campaigns, risk-based sampling, manager attestation
Architect SSO federation — SAML, OIDC, SCIM provisioning, app onboarding patterns
Implement privileged access — PAM vaulting, JIT elevation, session recording, break-glass policy
Author cloud IAM roles, policies, permission boundaries, trust relationships (AWS/GCP/Azure)
Govern service accounts and secrets — naming, rotation, no human keys, workload identity
Define separation of duties matrices and toxic-combination detection
Align IAM controls to audit and risk narratives (with GRC partners)