Last updated: October 11, 2026
By Devin Hornick, Co-Founder, KORE1
An IAM engineer job description should name the identity track, the HR and directory systems it connects, how many human and non-human identities it governs, the audit that sets its calendar, the engineer’s authority, and a pay range. Most postings name three vendors and stop.
“We got 214 Okta admins.”
That was the director of security at a specialty insurer outside Morristown, New Jersey, on the phone with me in May of last year. Roughly 2,600 employees. Workday for HR, SailPoint IdentityIQ 8.4 for governance, Okta in front of 410 applications. His posting read like most IAM postings read. IAM Engineer. Okta, SailPoint, CyberArk. Seven-plus years. Competitive salary. Three weeks, 214 applicants, and the people who applied were mostly very capable Okta administrators who had never written a SailPoint provisioning rule in their lives.
His actual problem was 1,300 contractors.
They lived in SAP Fieldglass, not Workday, so the joiner-mover-leaver automation never saw them leave. The SOX ITGC testers had found 212 contractor accounts still active after their end dates. Nobody had written that down anywhere a candidate could read it. So nobody who had solved that exact problem applied.
Two weeks later New Jersey’s pay transparency law took effect on June 1, 2025, and his HR team had to repost the role with a range anyway. We used the repost. Same title. A new first paragraph with the contractor count, the Fieldglass detail, the audit finding, and a $155,000 to $185,000 range. Forty-six people applied. The engineer we placed came from a bank on the Jersey City waterfront, had closed nearly the same finding there in 2023, and started at $171,000.
I’m Devin Hornick. I co-founded KORE1, and I’ve spent about 30 years in technology recruiting, most of it watching good roles sit open because the posting described a vendor list instead of a job. Our IAM engineer staffing desk gets paid when one of these searches closes, so weigh what follows knowing that. What follows is also free, and you can use every word of it without calling us.
Pick the Track Before You Write a Single Requirement
We already wrote the long version of this. Our guide to hiring an IAM engineer splits the title into five jobs: governance, privileged access, single sign-on and federation, customer identity, and machine identity. Read that table first. I won’t repeat it here.
The posting’s job is narrower. Its first sentence has to say which of the five you’re buying, in words a candidate can match to their last two years. Some examples, none of them shaped the same.
- “You’ll own SailPoint IdentityIQ for 4,000 employees and 1,300 contractors, and the next SOX cycle starts in February.”
- Privileged access. “We have 63 people who know the production database password. By next summer the number should be four, and they should all be in CyberArk.”
- A federation seat reads differently, usually as a migration with a date on it. AD FS off by Q3, 140 SAML apps to move into Entra ID, conditional access rebuilt along the way.
- Customer identity is its own world. Auth0 or Cognito, monthly active users, passkey adoption, bot traffic at the login page.
Machine identity is the fifth track and the youngest one. More on that in the counts.
Put the Counts in the Posting
Identity engineers think in numbers. How many people, how many accounts, how many apps, how many of those are actually wired up. A posting without numbers forces them to guess the scale, and senior people who guess wrong don’t apply.
Five numbers do most of the work.
| Count to Publish | Example Line | What a Senior Candidate Reads Into It |
|---|---|---|
| Workforce identities | 2,600 employees across 11 states | Whether their last estate was bigger or smaller, and by how much |
| Contractors and where they live | 1,300 contractors in SAP Fieldglass, not in Workday | Where the offboarding gap is, before the first interview |
| Non-human identities | About 7,400 service accounts, last counted in March | Whether anyone has looked, and how honest you’ll be |
| Applications, federated vs. not | 410 apps behind Okta, roughly 160 still on local logins | How much onboarding work is waiting for them |
| Directories and tenants | Two AD forests from a 2022 acquisition, one Entra ID tenant | Whether a consolidation project is hiding inside the job |
The service account number is the one clients fight me on. They don’t know it, or they know it and it’s embarrassing. Publish an estimate and the month it was taken. “About 7,400, last counted in March” tells a candidate you’ve started. Leaving it out tells them you haven’t, and the strong ones have already lived through a year at a company that hadn’t.
Will printing counts help an attacker? Not much. Counts aren’t vulnerabilities. Version numbers of unpatched systems are, and those don’t belong in a posting.
Name the Systems of Record
Every identity program runs downstream of an HR system, so the posting should name it. Workday, UKG Pro, SAP SuccessFactors, Oracle HCM Cloud, ADP Workforce Now. They aren’t interchangeable. Connector behavior, effective-dated hires, rehire matching, and the way a termination entered at 4:58 p.m. on a Friday lands in IdentityIQ or Okta Workflows all differ by platform. An engineer who has built joiner-mover-leaver logic off Workday business processes is useful on your Workday tenant in a week. On UKG Pro, give it a quarter.
Then contractors. Usually SAP Fieldglass or Beeline, sometimes a ServiceNow catalog item, sometimes an Excel file somebody in procurement owns. Be honest about which one. Then the directory story in one line: how many Active Directory forests, whether Entra ID syncs through Entra Connect or Cloud Sync, and whether a 1990s-era LDAP directory still answers for an IBM mainframe. Three short paragraphs, and they filter harder than the requirements list will. The hire guide’s best screening question walks that same Friday termination from HR record to the last dead session, and your posting should let a candidate picture the walk before applying.
Say Which Audit Owns the Calendar
Identity work is evidence work. Some seats spend 15 percent of the week producing it. Some spend half. Candidates want to know which, and the audit framework tells them.
SOX ITGC means quarterly user access reviews for in-scope financial systems and testers who sample terminations. SOC 2 means the CC6 logical access criteria and an annual report a customer will ask for. PCI DSS 4.0 made multi-factor authentication mandatory for all access into the cardholder data environment once requirement 8.4.2 became effective on March 31, 2025, so a card-handling shop is hiring someone to keep that true. HIPAA, FedRAMP, and NIST 800-53’s access control family each have their own rhythm. Name the ones that apply and the month the next cycle starts.
Why does this matter so much in 2026? The 2026 Verizon Data Breach Investigations Report looked at more than 22,000 confirmed breaches. Credential abuse fell to 13 percent as the first way in, behind exploited vulnerabilities at 31 percent, but counted anywhere in the breach it still came out on top at 39 percent. Stolen logins are how attackers move once they’re inside. Auditors read the same report. So do candidates. A posting that says “SOX and SOC 2, next access review cycle opens January 15” is telling a serious engineer that the work is real and the dates are known.
Responsibilities, Rewritten as Outcomes
Search the phrase and the published templates all say roughly the same thing. Manage authentication and authorization. Implement SSO and MFA. Perform access reviews. Every line is true for every IAM job ever posted, which is why none of them help a candidate decide.
| The Line Every Template Has | The Line That Gets the Right Applicant |
|---|---|
| Implement and maintain SSO and MFA | Move the last 160 local-login apps into Okta and get phishing-resistant MFA to 100% of admins by June |
| Manage user provisioning and deprovisioning | Bring 1,300 Fieldglass contractors into IdentityIQ so an end date disables access within four hours |
| Conduct periodic access reviews | Cut the quarterly SOX review from nine weeks to three and stop managers approving 90% in the last two days |
| Support privileged access management | Vault the 63 shared production credentials in CyberArk and rotate them every 30 days |
| Ensure compliance with security policies | Own the evidence for SOX ITGC and SOC 2 CC6, and close the 2025 contractor finding before the next test |
| Automate identity workflows | Replace 40 hand-run PowerShell scripts with IdentityIQ workflows a second engineer can maintain |
Four to six of those. No more. If you can’t write the outcome version of a line, it probably isn’t a real responsibility yet, and it should come out.
Be Honest About the Pager
Okta publishes its incident history on a public status page, and Microsoft does the same for Entra ID. Your own outages are shorter lists, and your candidates will ask about them anyway. At the Morristown insurer, a SCIM sync job against Workday failed silently for six days in 2024, and 37 new hires started without email. That one went into the posting, roughly, as a reason the seat exists.
So print the rotation. One week in five is common for a team of four or five engineers. List what pages (IdP outage, Workday sync failures, a CyberArk vault refusing checkouts at 2 a.m.) and how often it fired last quarter. “Paged four times in Q2, two after 10 p.m.” takes 9 words. Skip it and the on-call conversation happens at the offer stage instead, which is the most expensive place to have it.
The Pay Line, Under New Jersey Rules
I picked New Jersey for this one deliberately. A lot of identity hiring happens there, in the banks and insurers between Jersey City and Newark and the pharma companies down the Route 1 corridor, and the state’s law reaches further than most people assume.
According to the New Jersey Department of Labor, the law covers employers with 10 or more employees over 20 calendar weeks that do business, employ people, or take applications in New Jersey. A remote role posted nationally counts if you accept applications from New Jersey residents. Postings have to show the wage or salary or a range, plus a general description of benefits and other compensation programs. “Up to $190,000” doesn’t comply, because the range needs a bottom. Internal postings and transfers are covered too. Penalties run up to $300 for a first violation and $600 for each one after.
Then the numbers themselves. Our IAM engineer salary guide reconciles six public sources against closed searches, and these bands come straight from it.
- IAM analyst or administrator, $78,000 to $110,000 base.
- Mid-level IAM engineer, $115,000 to $155,000.
- Senior, $150,000 to $200,000. The Morristown hire landed at $171,000, right in the middle.
- Identity architect, $185,000 to $245,000.
- Privileged access seats typically run $10,000 to $25,000 above those bands at the same level, and senior contract rates sit around $105 to $160 an hour.
For the budget conversation, the Bureau of Labor Statistics puts the median wage for information security analysts, the occupation most identity roles fall under, at $129,180 for May 2025, with 21 percent projected growth from 2025 to 2035 and about 14,100 openings a year. Identity sits above that median, not at it. If your metro is unusual, run it through our salary benchmark tool before the range goes in the posting.
Write Down What They’re Allowed to Say No To
Experienced identity engineers look for this line first, and maybe one posting in ten has it.
Can the engineer block a new SaaS app from production if it lacks SAML or OIDC sign-on and SCIM 2.0 provisioning? Who signs off when a vice president of finance wants standing Domain Admin in a 2008-era forest? At the Morristown insurer the answer was a two-line policy. The IAM engineer blocks, the CISO approves exceptions for 90 days at most, and the exception list goes to the audit committee every quarter. If yours is “the engineer recommends, the CISO decides,” print that. What drives people out in month seven is learning the authority was never there, a pattern the hire guide covers in its section on searches that die.
Their own access is the other half. An IAM engineer typically holds Okta Super Admin, Entra ID Global Administrator, or the CyberArk Vault Admin role, often two of the three. Say who approves those grants, because under any SOX or SOC 2 reading the answer can’t be the engineer. Say whether the two Entra break-glass accounts Microsoft recommends are excluded from conditional access, alerted on, and held under split custody. Senior candidates we put forward ask about segregation of duties on their own account in round one, often before they ask about remote days. Answer it in the posting. Then add the reporting line, security or IT operations, and the title it lands on.
IAM Engineer Job Description Template
Copy it, fill the brackets, delete the “Internal:” notes before it goes live.
Job Title
[IAM Engineer] or [Senior IAM Engineer, Identity Governance] or [IAM Engineer, Privileged Access]. Internal: if HR needs the plain title, put the track in the first sentence of the next section.
The Identity Estate
[Company] has [number] employees and [number] contractors across [locations]. Our people data lives in [Workday / UKG Pro / SAP SuccessFactors / Oracle HCM / ADP], contractors are managed in [SAP Fieldglass / Beeline / other], and we run [number] Active Directory [forest / forests] with [one / two] Entra ID [tenant / tenants]. About [number] applications sign in through [Okta / Entra ID / Ping], and roughly [number] still don’t. We estimate [number] service accounts and other non-human identities, last counted in [month and year].
What You’ll Own in Your First Year
[Four to six outcome lines, each with a number and a date. Example: Bring [number] contractors into [IGA platform] so an end date disables access within [hours]. Example: Cut the quarterly access review from [weeks] to [weeks].]
Platforms You’ll Work In Every Week
[Primary platform and version, for example SailPoint IdentityIQ 8.4 or Identity Security Cloud]. [Secondary platforms you touch but don’t own]. [Scripting: PowerShell, Python, or both, and what for]. Internal: name one primary platform. Two at most.
Audits and Evidence
This role supports [SOX ITGC / SOC 2 / PCI DSS 4.0 / HIPAA / FedRAMP]. Our next [access review / audit cycle] opens in [month]. Expect evidence work to take roughly [percent] of a normal week.
Authority and Reporting
You’ll report to [title] in [security / IT operations]. You [can / cannot] block an application from production if it doesn’t meet our SSO and provisioning standard. Exceptions are approved by [title]. Your own privileged access is approved by [title], and break-glass credentials are held by [two named roles].
On-Call
[One week in five / other rotation]. Pages cover [IdP outage, provisioning failures, vault access]. Last quarter the rotation was paged [number] times, [number] after hours.
What You Bring
[Three must-haves, each tied to something already named above. Example: You’ve built joiner-mover-leaver automation off [HR system] at a company with at least [number] identities.] [One sentence on the audit framework you need them to have lived through.]
Not Required
[A CISSP. A computer science degree. Experience with every platform listed above.] Internal: say what you won’t screen on. It widens the right part of the pool.
The Interview Loop
[Number] conversations over about [number] weeks: [recruiter screen, a technical walk-through of a real scenario from our estate, a panel with the people you’ll work with]. No unpaid take-home.
Pay, Benefits, and Location
Base salary range: $[low] to $[high]. [Bonus target, equity if any]. Benefits: [medical, dental, vision, 401(k) match, PTO, any others available in the first 12 months]. Location: [on-site / hybrid, days per week / remote within (states)]. Internal: New Jersey, Colorado, Washington, New York, California, and several other states require the range; publish one with a real bottom and top whatever state you’re in.
Before the Req Goes Live, Security Leaders Ask Us
Won’t our identity counts hand attackers a map?
Not really. Counts describe scale, not weakness, and they’re the single fastest way to tell a senior candidate whether your estate matches what they’ve run.
What stays out is anything specific and exploitable, like unpatched product versions, the name of a homegrown app with no MFA, or which vendor holds your break-glass process. Round the numbers if it helps. “About 7,000 service accounts” is plenty.
We use Okta and SailPoint both. Should the title say so?
Keep vendors out of the title and put the primary one in the first sentence. Titles with two or three vendor names read like a requirements list, and search engines index them poorly.
How many years of experience should the posting ask for?
Five is what most postings print, and it’s the wrong unit.
Ask for something shipped instead. “You’ve run at least two SOX access review cycles end to end” filters harder than “5+ years,” because plenty of people have five years of handling access tickets and have never owned a review. If HR insists on a number, use it as a floor in the qualifications and lead with the shipped work. We’ve placed senior engineers with four years who’d done more than candidates with twelve.
We’re fully remote and nowhere near New Jersey. Does the range rule still apply?
Probably, if you have 10 or more employees and accept applications from New Jersey residents.
The New Jersey Department of Labor reads the law to include national postings for remote work that can be done from the state. Several other states have similar reach. The practical answer is the same everywhere. Publish a real range with a bottom and a top on every IAM posting, and stop worrying about which state’s rule is the strictest.
Should the posting mention AI agents and non-human identity?
Only if the work exists. If you’re deploying agents or heavy automation in the next year, say how many service accounts you have and who owns them today, and candidates who’ve handled that will find you.
If it isn’t on your roadmap, leaving it out is fine. Adding “experience with AI identity” as a buzzword pulls applicants who’ve read the same vendor blogs you have. The interview is where you test depth, and our set of IAM engineer interview questions includes a workload identity question built from a real OIDC trust-policy mistake.
Can one posting cover a contractor and a full-time hire?
No, write two. A contract posting has an end date and a handoff, and a permanent posting has a first-year roadmap, and candidates for each skip the other.
A six-month SailPoint upgrade or an AD FS retirement is a natural fit for contract IAM staffing. Building the identity function your company will still have in five years is a direct hire search, and the posting should read like one. If you’re not sure which you have, that’s a good reason to call before posting either.
Post the Counts
The Morristown posting didn’t get better because it got longer. It got better because it said 1,300 contractors in Fieldglass, 212 accounts flagged by the SOX testers, Workday upstream, and a range with a real bottom. Everything a strong candidate needed to recognize their own last job.
Your team already knows those numbers. Somebody just has to type them.
For neighboring seats, our templates for a security engineer job description, a cloud security engineer posting, and a DevSecOps engineer role follow the same logic, and the wider cybersecurity staffing practice covers the roles around them.
KORE1 has been placing technology people since 2005. Our recruiters average more than 15 years each, we work across 30-plus U.S. metros, our average IT fill time is 17 days, and 92 percent of our placements are still in the seat at twelve months. If you’d like a second set of eyes on an IAM posting before it goes up, send the draft to a recruiter. Our identity and access management search team will tell you which count is missing.
