IAM Administrator / Support Analyst

Introduction

The IAM Administrator / Support Analyst is responsible for the day-to-day administration, support, and operational management of the organisation's Identity and Access Management (IAM) platform across both customer-facing (external consumer identity) and internal workforce identity environments.

The role focuses on user onboarding, client and application registration, access management, authentication support, identity governance, and compliance-related activities. Working closely with application teams, business stakeholders, and security teams, the successful candidate will ensure secure and effective user access while maintaining the integrity, reliability, and security of IAM services. The role is responsible for enforcing security baselines, least privilege principles, and access governance controls while supporting secure authentication and authorisation processes across the enterprise.

Duties & Responsibilities

• Manage user onboarding, offboarding, and access provisioning activities.

• Configure and maintain clients, applications, and realm registrations within the IAM platform.

• Create and manage role mappings, groups, and access permissions.

• Perform user credential resets and support authentication-related requests.

• Manage redirect URIs and client configuration changes in line with security standards.

• Validate and enforce secure client registration standards, including verification of strict Redirect URI configurations, prevention of wildcard (*) callback registrations, validation of token lifespan settings, and enforcement of PKCE for public clients.

• Manage active user sessions, token revocations, backchannel logout events, and brute-force detection lockouts.

• Utilise the Keycloak Admin REST API and kcadm.sh CLI for batch operational tasks and standard provisioning workflows.

• Monitor and inspect audit logs to support compliance, troubleshooting, and security investigations.

• Query and analyse logs using OpenSearch, Elastic Stack, CloudWatch, or equivalent logging and monitoring platforms.

• Assist with Single Sign-On (SSO) and federation-related support activities.

• Troubleshoot user access, authentication, authorisation, token, and federation-related issues.

• Support identity governance and access review processes.

• Maintain operational documentation, procedures, and support guides.

Desired Experience & Qualification

• Bachelor's Degree or Diploma in Information Technology, Computer Science, Information Systems, or a related field.

• Minimum of 3 years' experience in Identity and Access Management, Application Support, or Systems Administration.

• Proven experience administering Keycloak environments.

• Mandatory hands-on experience with:

• Keycloak Admin Console.

• Keycloak Admin REST API.

• kcadm.sh CLI.

• Client administration.

• Realm administration.

• User and role management.

• Identity federation.

• Knowledge of user lifecycle management, access provisioning, and identity governance processes.

• Experience supporting password resets, credential management, and user authentication processes.

• Practical working knowledge of OAuth 2.0 and OpenID Connect (OIDC), including:

• Authorization Code Flow with PKCE.

• Client Credentials Flow.

• Token-based authentication concepts.

• Ability to inspect, decode, and troubleshoot JWT tokens, claims, scopes, and authentication-related issues.

• Experience querying and analysing logs using OpenSearch, Elastic Stack, CloudWatch, Splunk, or similar monitoring and SIEM platforms.

• Understanding of security best practices related to identity and access management, including least privilege access principles.

• Experience working with Active Directory, LDAP, or Microsoft Entra ID as federation and identity sources.

• Strong troubleshooting and incident management skills.

• Excellent communication and customer service abilities.

• Ability to work effectively with technical and non-technical stakeholders.

• Experience within Telecommunications, Financial Services, Consulting, or large-scale enterprise environments will be advantageous.