IAM manages the identities and access rights of employees and partners; CIAM does the same for customers, with scale and ease of use as extra requirements. Within IAM we distinguish five profiles: architect, engineer, consultant, IGA specialist and PAM specialist. Which one you need depends on your goal: a new programme, a customer portal, compliance or administrator accounts.
IAM vs CIAM: what is the difference?
IAM and CIAM look alike, but they serve different users and have different priorities.
IAM: internal identity and access management
Traditional IAM focuses on managing the identities and access rights of employees, contractors and partners within an organisation. The emphasis is on least privilege, segregation of duties and automating joiner-mover-leaver processes. Typical IAM platforms are SailPoint, Saviynt, One Identity and Microsoft Entra ID (formerly Azure AD). In internal IAM, compliance and security come first: who has access to which systems, and is that access justified?
CIAM: customer identity and access management
CIAM manages the identities of external users, in other words customers. Here the user experience is central, alongside security. CIAM solutions have to scale to millions of users, offer self-service registration and password recovery, and comply with privacy rules such as the GDPR. Well-known CIAM platforms are Auth0 (from Okta) and Ping Identity, into which ForgeRock was combined in 2023. A poor CIAM implementation costs customers and revenue directly, so the business impact is often greater than with internal IAM.
The five IAM profile types
Within the IAM domain, we at MVPeople distinguish five main profiles, each with its own expertise and area of deployment:
- IAM Architect: Designs the overall IAM architecture, selects platforms and defines integrations. Requires broad knowledge of IAM standards (SAML, OAuth, OIDC, SCIM) and experience with enterprise architecture. Typically a senior profile with 8+ years of experience. The IAM Architect is the starting point for any larger IAM transformation.
- IAM Engineer / Developer: Implements and configures IAM solutions. A hands-on technical profile working with specific platforms such as SailPoint, Saviynt or Microsoft Entra. Often 3 to 7 years of experience with one particular platform. IAM Engineers are the builders who turn the architect's vision into working solutions.
- IAM Consultant / Analyst: Carries out analyses, writes functional designs and guides implementation projects from the business side. This profile bridges technology and business, with knowledge of governance and compliance. Essential for translating business requirements into technical specifications.
- IGA Specialist: Specialised in Identity Governance and Administration. Focuses on access reviews, role mining, role-based access control (RBAC) and compliance reporting. Essential for organisations that must comply with SOX, NIS2 or sector-specific regulation. IGA is the part of IAM that makes sure access rights are demonstrably correct and up to date.
- PAM Specialist: Specialised in Privileged Access Management. Manages and secures administrator accounts and service accounts. Works with platforms such as CyberArk, BeyondTrust or Delinea (formed by the 2021 merger of Thycotic and Centrify, and named Delinea since 2022). This matters because attackers who get in often go looking for administrator rights next.
Which profile do you need?
The right IAM profile depends on your situation and goals. These are the most common scenarios:
You are starting a new IAM programme
Start with an IAM Architect who defines the vision, strategy and architecture. Once the architecture is in place, add IAM Engineers for the implementation. That fits well with a combination of MVPeople (interim architect) and MVProfessionals (seconded engineers for a long implementation). The architect can scale down after 3 to 4 months while the engineers carry on with the implementation.
You need to secure your customer portal
Here you need a CIAM specialist with experience in customer-facing identity solutions. Look specifically for experience with scalability, user experience design and privacy by design. CIAM expertise differs significantly from traditional IAM. A specialist who has worked with SailPoint for years is not automatically suited to a CIAM implementation in Auth0 or Ping Identity.
You need to meet compliance requirements
An IGA Specialist is essential for setting up access governance: access reviews, role management and compliance reporting. Combine this with a GRC consultant for the wider compliance context if needed. More and more organisations bring in IGA as part of their NIS2 or SOX programme.
You want to secure privileged accounts
A PAM Specialist with experience in CyberArk, BeyondTrust or similar platforms is the right choice here. PAM implementations are complex and require specific platform knowledge. Besides the technical implementation there is change management: administrators have to get used to a new way of working.
Interview questions for IAM candidates
When selecting an IAM specialist, we recommend asking the following questions to test the depth of their knowledge:
- Which IAM platforms have you implemented, and in what role? Ask about the size and complexity of those implementations.
- How would you design a joiner-mover-leaver process for an organisation with 7,000 employees? This tests both technical and process knowledge.
- What is your experience with federation standards such as SAML 2.0, OAuth 2.0 and OpenID Connect? A good IAM specialist knows these standards in detail.
- How do you approach a role mining project, and which methodology do you use? This shows whether the candidate has experience with the governance side of IAM.
- Can you give an example of a complex IAM integration scenario you solved? Concrete examples say more than theoretical knowledge.
How MVPeople Group helps
MVPeople Group has an extensive network of IAM specialists across all profile types. Through MVPeople you can quickly bring in interim IAM architects and consultants for short assignments and urgent needs. Through MVProfessionals we provide seconded IAM engineers for longer implementation projects, with the option of moving to permanent employment after 6 to 12 months.
Read more about our IAM and PAM expertise, or get in touch for a no-obligation conversation about which profile fits your needs.