IAM manages the identities and access rights of employees and partners; CIAM does the same for customers, with scale and ease of use as extra requirements. Within IAM we distinguish five profiles: architect, engineer, consultant, IGA specialist and PAM specialist. Which one you need depends on your goal: a new programme, a customer portal, compliance or administrator accounts.
IAM vs CIAM: what is the difference?
IAM and CIAM look alike, but they serve different users and have different priorities.
IAM: internal identity and access management
Traditional IAM focuses on managing the identities and access rights of employees, contractors and partners within an organisation. The emphasis is on least privilege, segregation of duties and automating joiner-mover-leaver processes. Typical IAM platforms are SailPoint, Saviynt, One Identity and Microsoft Entra ID (formerly Azure AD). In internal IAM, compliance and security come first: who has access to which systems, and is that access justified?
CIAM: customer identity and access management
CIAM manages the identities of external users, in other words customers. User experience matters as much as security here. CIAM solutions have to scale to millions of users, offer self-service registration and password recovery, and comply with privacy rules such as the GDPR. Well-known CIAM platforms are Auth0, part of Okta since 2021, and Ping Identity, into which ForgeRock was combined in 2023. A poor CIAM implementation costs customers and revenue directly, so the business impact is often greater than with internal IAM.
The five IAM profile types
At MVPeople we split the IAM field into five main profiles.
- IAM Architect: Designs the overall IAM architecture, selects platforms and defines integrations. Requires broad knowledge of IAM standards (SAML, OAuth, OIDC, SCIM) and experience with enterprise architecture. Usually a senior with years of experience in large environments. For a bigger IAM transformation, this is the first hire.
- IAM Engineer / Developer: Implements and configures IAM solutions. A hands-on technical profile working with specific platforms such as SailPoint, Saviynt or Microsoft Entra. The engineer builds what the architect has designed.
- IAM Consultant / Analyst: Carries out analyses, writes functional designs and guides implementation projects from the business side. This profile bridges technology and business, with knowledge of governance and compliance. They turn what the business wants into technical specifications.
- IGA Specialist: Specialised in Identity Governance and Administration. Focuses on access reviews, role mining, role-based access control (RBAC) and compliance reporting. You need this profile when you have to demonstrate compliance with SOX, NIS2 or sector-specific regulation. IGA is the part of IAM that makes sure access rights are demonstrably correct and up to date.
- PAM Specialist: Specialised in Privileged Access Management. Manages and secures administrator accounts and service accounts. Works with platforms such as CyberArk, BeyondTrust or Delinea (formed by the 2021 merger of Thycotic and Centrify, and named Delinea since 2022). This matters because attackers who get in often go looking for administrator rights next.
Which profile do you need?
The right IAM profile depends on your situation. These are the ones that come up most.
You are starting a new IAM programme
Start with an IAM Architect who defines the vision, strategy and architecture. Once the architecture is in place, add IAM Engineers for the implementation. That fits well with a combination of MVPeople (interim architect) and MVProfessionals (seconded engineers for a long implementation). The architect can then scale down while the engineers carry on with the implementation.
You need to secure your customer portal
Here you need a CIAM specialist with experience in customer-facing identity solutions. Look specifically for experience with scalability, user experience design and privacy by design. CIAM calls for different experience from traditional IAM. A specialist who has worked with SailPoint for years is not automatically suited to a CIAM implementation in Auth0 or Ping Identity.
You need to meet compliance requirements
Bring in an IGA specialist to set up access governance: access reviews, role management and compliance reporting. Combine this with a GRC consultant for the wider compliance context if needed. That makes IGA a good fit for a NIS2 or SOX programme.
You want to secure privileged accounts
A PAM Specialist with experience in CyberArk, BeyondTrust or similar platforms is the right choice here. PAM implementations are complex and require specific platform knowledge. There is change management to handle too: administrators have to get used to a new way of working. If you work at a bank or insurer, read DORA privileged access management as well.
Interview questions for IAM candidates
These questions show how deep an IAM specialist's knowledge really goes.
- Which IAM platforms have you implemented, and in what role? Ask about the size and complexity of those implementations.
- How would you design a joiner-mover-leaver process for an organisation with 7,000 employees? This tests both technical and process knowledge.
- What is your experience with federation standards such as SAML 2.0, OAuth 2.0 and OpenID Connect? A good IAM specialist knows these standards in detail.
- How do you approach a role mining project, and which methodology do you use? This shows whether the candidate has experience with the governance side of IAM.
- Can you give an example of a complex IAM integration scenario you solved? Concrete examples say more than theoretical knowledge.
How MVPeople Group helps
Through MVPeople you can quickly bring in interim IAM architects and consultants for short assignments and urgent needs. Through MVProfessionals we provide seconded IAM engineers for longer implementation projects, with the option of moving to permanent employment after 6 to 12 months.
Read more about our IAM and PAM expertise, or call or email me if you want to talk through which profile fits.
