How to Become an Identity Engineer

Identity engineering is one of the most durable specialties in security, and you do not need a specific degree to get in. You need a handful of protocols understood deeply, real hands-on time with platforms, and the ability to explain trade-offs. This page is the skills and lab plan: what to learn, in what order, and what to build to prove it. For the map of roles, see IAM career paths; for the job search itself, see how to get an IAM job.

What an identity engineer actually does

On a typical week you might onboard three SaaS applications to SSO, debug why a SAML assertion is rejected after a certificate rollover, write a script that finds accounts with no owner, tune a conditional access policy that is blocking a contractor group, and review a developer's OAuth integration. The common thread: you translate between protocols, platforms, and people, and you make access correct by default rather than by ticket.

The skill stack, in learning order

1. Concepts first. Authentication vs authorization, OAuth vs OIDC, SAML vs OIDC, and access models (RBAC vs ABAC vs ReBAC). The glossary and standards deep dives are built for this.
2. Tokens. What is in a JWT, how signatures are verified with a JWKS, and the difference between an ID token, an access token, and a refresh token.
3. Federation. SAML metadata, certificates, and assertions; OIDC discovery and client registration.
4. Lifecycle. SCIM, joiner-mover-leaver, and why the mover case is where access piles up.
5. Authentication strength. MFA, phishing-resistant MFA, passkeys, and recovery.
6. Platform depth. One workforce platform properly (Microsoft Entra or Okta for most employers), then a second.
7. Automation. PowerShell or Python against a platform API, plus infrastructure as code for identity configuration.
8. Attacker view. How identity is abused, from the attack techniques catalog.

A six-month lab plan

Each block assumes evenings and weekends. Keep every lab in one public GitHub repository with a README that explains what you built and why.

The recipes cover several of these step by step: OIDC with PKCE, validate a JWT, protect an API with OAuth scopes, set up SCIM provisioning, and add passkeys. The JWT decoder helps you inspect tokens while you work.

Build against the current rules, not old tutorials

Many tutorials still teach patterns the standards bodies have since retired. Learn the current guidance from the start:

• The OAuth 2.0 Security Best Current Practice, RFC 9700 (January 2025), says clients should not use the implicit grant, the resource owner password credentials grant must not be used, public clients must use PKCE, and authorization servers must use exact string matching for redirect URIs. See OAuth 2.1.
• NIST SP 800-63B-4 requires passwords used as a single factor to be at least 15 characters, forbids composition rules and periodic forced rotation, and requires a phishing-resistant authenticator at AAL3. See NIST 800-63.

If a course tells you to use the implicit flow or force 90-day password changes, it is out of date.

Build the security mindset

Study how identity actually fails. The breach teardowns and techniques show the real patterns: MFA fatigue, help desk social engineering, session cookie theft, and mover entitlement accumulation. For each lab you build, ask how an attacker would abuse it, then add the control. Being able to explain how a breach happened and which identity control would have stopped it is what separates an engineer from a console operator.

Prove it

Pick up a certification that matches the platform you practiced on, contribute to an open-source identity project, and write up what you built. A short post explaining a SAML rollover you broke and fixed is more convincing than a badge. Then rehearse with the interview questions and the open-source IAM interview questions bank.

Skills checklist

Use this as a self-assessment. Aim to be able to do, not just define, each item.

• Explain authentication vs authorization and why an access token is not proof of login.
• Implement the OAuth authorization code flow with PKCE end to end.
• Validate a JWT: signature, issuer, audience, expiry, and JWKS key rotation.
• Configure SAML SSO and SCIM provisioning against a test app.
• Add MFA and passkeys and explain phishing resistance.
• Reason about an access model: RBAC vs ABAC vs ReBAC.
• Walk through a real identity breach and the control that would have stopped it.
• Automate a task with a platform API or script.
• Explain how a service account or workload identity differs from a human account and how you would govern it.

Keep learning

Follow a topic through the podcast learning paths, such as OAuth and OIDC or SAML. Read the people who wrote the specs in the experts directory, and when you can, attend a practitioner event from the conferences list.

Your next step

Validate your fundamentals with a certification, then move to how to get an IAM job for the resume and search, and browse the IAM career paths to see where the role can lead.