Hiring an IAM lead: profile, responsibilities and assessment

Who has access to what, why, and since when? In many organisations, nobody can answer with confidence. The IAM (Identity and Access Management) lead is the person whose job is to make that answer simple, verifiable and current. This guide helps you define the role, pick the right profile and assess candidates on concrete situations.

Why identity management became a board-level topic

Access has multiplied: SaaS applications, public cloud, on-premises directories, business tools, contractors, technical accounts. Every new component adds identities and permissions, which are rarely removed as fast as they are granted. A former employee's account left active, a contractor who keeps access after the engagement ends, or an over-privileged service account is often all an attacker needs.

Regulation points the same way. Among the expected risk management measures, the NIS2 directive explicitly lists access control policies and the use of multi-factor authentication (Article 21, available on eur-lex.europa.eu). ANSSI, the French national cybersecurity agency, also publishes recommendations on authentication and secure administration. If NIS2 applies to you, our article on the security profiles to hire first places IAM among the other workstreams.

Auditors, finally, ask for evidence: access reviews completed, leavers processed on time. Without an owner, every audit turns into a spreadsheet campaign.

What IAM covers

The term is broad. Before hiring, identify the areas that really matter to you.

Few organisations need deep expertise in all of these areas from day one. If you also manage your customers' accounts (CIAM), add that to the scope. Most start with governance and access management, then tackle privileged access.

What an IAM lead does

Depending on your maturity, the IAM lead:

• defines the identity and access policy: provisioning rules, least privilege, segregation of duties, authentication requirements;
• builds the processes with HR and the business: joiners, movers and leavers, contractor accounts, access requests and approvals;
• runs the tooling projects: selecting and deploying a governance, SSO or PAM solution, and connecting applications step by step;
• organises access reviews and makes sure managers understand what they approve;
• tracks metrics: orphaned accounts, deactivation lead times, strong authentication coverage, connected applications;
• handles audits and provides the evidence required;
• works with the SOC so that authentication anomalies and privilege changes are monitored.

The role is as much organisational as technical. A large part of the job is getting HR, IT, the business and security to agree on rules they will actually follow.

Scoping the role

Lead, engineer or architect?

Three profiles often share the "IAM" label:

• The IAM lead owns the policy, the processes and the roadmap. They make trade-offs and report on progress.
• The IAM engineer configures and integrates the tools: connectors, provisioning flows, application federation, automation scripts.
• The identity architect designs the overall target state, often during a redesign or a move to the cloud. Our guide to hiring a security architect covers that profile.

In a mid-sized organisation, one role often combines lead and engineer. Say so clearly in the job ad, along with the real share of hands-on work.

Reporting line

Reporting to the CISO gives the IAM lead legitimacy as a control function, but they will have to persuade IT to execute. Reporting to IT gives them control of the tools, but you must make sure security keeps oversight. Both models work if the mandate is explicit. What does not work is a role with no authority over HR processes or tools.

The environment

State in the job ad: the directories in place, the share of cloud and SaaS, existing tools, a rough number of business applications, and the use of contractors. If your estate is mostly Microsoft and the main issue is hardening the directory, the need is closer to the one described in our article on hiring an Active Directory expert.

Skills to check

Technical fundamentals

Even a strongly governance-oriented lead must understand what they are steering:

• federation and authentication protocols (SAML, OpenID Connect, OAuth 2.0, Kerberos) and when each one is used;
• authorisation models (roles, attributes) and their limits in practice;
• how automated provisioning from an HR source works;
• the principles of privileged account protection;
• the specifics of cloud identities and technical accounts.

Role design

Building a role model is delicate. Too many roles and the model becomes unmanageable. Too few and everyone gets more access than they need. A good candidate starts from what exists, moves forward one scope at a time and accepts documented exceptions.

Process and compliance sense

The IAM lead must be able to design a leaver process that works even when the manager forgets to say anything, or run an access review that managers do not approve in one click without reading. They will work closely with the GRC team. Our guide to hiring a GRC analyst helps split responsibilities between the two roles.

Finally, removing access and enforcing strong authentication create friction. The candidate must be able to explain, negotiate and prioritise without giving up on what matters.

How to assess candidates

The case study

A concrete exercise tells you more than a CV walkthrough, as we explain in our article on assessing skills beyond the CV. A format that works well for this role:

1. Describe a fictional organisation: one directory, around ten applications including some SaaS, contractors, and an audit that found former employees' accounts still active.
2. Provide a small anonymised extract: a list of accounts with their HR status and permissions.
3. Ask the candidate to spot the anomalies, then propose a six-month plan: processes, tooling, quick wins, metrics.
4. Finish with a trade-off question: a business director refuses to remove a shared account. What do you do?

Look at prioritisation and realism. A candidate who wants to roll out a full platform before the HR source is reliable has probably never taken this kind of project all the way.

Interview questions

• "How do you make sure a departure triggers the deactivation of every access?" Expect an HR source of truth, automation and an after-the-fact check, not just a written procedure.
• "How do you run an access review that is actually useful?" Look for answers on scope, how readable the permissions are for managers, and how removals are followed up.
• "Explain the difference between SAML and OpenID Connect to a project manager." You test understanding and teaching skills at once.
• "What do you do with service accounts whose owner nobody knows?" A good answer covers inventory, analysis of actual usage and gradual removal.
• "Tell me about an IAM project that went wrong." Clear thinking about the causes (unreliable HR data, applications that could not be connected, no sponsor) is an excellent signal.

To compare candidates consistently, use our method to structure a technical security interview.

Where to find these profiles

IAM leads often come from:

• IAM tool integration at a vendor or integrator, looking to own a programme over time;
• directory administration, gradually moving towards governance;
• GRC or audit consulting, for people used to access controls and reviews;
• IT project management, for people who have led SSO or governance rollouts.

These profiles are usually employed: describe the real mandate and the starting point rather than a list of tools.

Mistakes to avoid

• Buying the tool before hiring the person. A governance platform without an owner or processes stays an empty shell.
• Forgetting HR. Without reliable HR data, no automated lifecycle holds up.
• Requiring expertise in a single vendor. A tool can be learned. Understanding processes and protocols takes much longer.
• Underestimating the human side. A brilliant technician who cannot talk to the business will get stuck on access reviews and role design.
• Giving no mandate. Without leadership support, the IAM lead can neither remove access nor enforce strong authentication.

In short

The IAM lead makes your access controlled and demonstrable. Choose your priority areas first, clarify the reporting line and the mandate, then assess candidates on a case study that combines concrete anomalies, prioritisation and trade-offs with the business.

Hiring for this role? At Cyber Recrut, a recruiter and a security practitioner scope the role with you and run the search together. Our shortlisted candidates prove their skills on hands-on labs, and you only pay when a hire succeeds. See how we work or share your hiring need.