Methodology: employer-posted IAM pay

Every salary figure on IdentityRoles is computed from the current job snapshot when the site is built. This page was last updated Oct 21, 2026, 12:22 AM ET.

Sources

Each day the refresh reads public employer job boards: Greenhouse, Lever, Ashby, and Workday career sites. A role is kept when the title is identity and access work. At companies whose product is identity, engineering and solutions titles are kept as well. The listing links to the original posting.

Inclusion rules

Published medians use practitioner roles only. Vendor sales and solutions titles are tagged vendor and left out of those medians. The salary tables have a control that adds them back. The sentences above the tables stay on practitioners.

Normalization

Median of employer-posted annual base pay. Hourly ranges are converted at 2,080 hours per year. Ranges in currencies other than USD are excluded. Each company counts at most 5 roles. Published medians use practitioner roles only; vendor sales and solutions roles are excluded. Job cards still show CAD, EUR, and GBP ranges. Those currencies are excluded from the USD medians. Hourly ranges are stored as annual amounts (the posted hourly rate times 2,080) and marked as estimates of annual base.

Seniority and platform tags

Seniority is read from the title. Director, VP, head, and chief become Director+. Principal, staff, distinguished, and architect become Staff/Principal. Senior, sr, and lead become Senior. Manager stays Manager, except technical account manager and engagement manager. Junior, intern, associate, and entry-level become Junior. A II or mid title becomes Mid. Anything else is Unspecified.

Platform tags match the title first. Description phrases are used only when the title names no platform. The PAM salary page and the PAM row on the hub both mean tags PAM, CyberArk, BeyondTrust, or Delinea. The IGA page and the IGA row both mean IGA, SailPoint, or Saviynt. A role can sit in more than one row. The CyberArk page counts only the CyberArk tag, and it does not reuse the PAM median.

Per-company cap

Inside a published median, each company counts at most 5 roles. The cap is applied after the tag filter, once for that group. The seniority table applies the cap inside each seniority, so a seniority row does not have to add up to the headline. The CSV is the uncapped list of USD practitioner postings. Reapply the cap to reproduce a median.

Small samples

A group with fewer than 5 posted ranges is labeled small sample in the text, including the seniority table. Those medians are anecdotal. Pay comparisons, including Okta versus SailPoint and remote versus on-site, are stated only when both sides have at least 5 ranges.

Update cadence

The job file refreshes daily. Salary pages, this methodology page, the CSV, and llms.txt are rebuilt from that file. A role drops off the board 45 days after the employer posted it. There is no separate historical changelog: the live snapshot replaces the previous one, and the Updated line is the snapshot time in America/New_York, labeled ET.

Known biases

US posted ranges often cover several metros, so midpoints run high next to a single-city survey or a single-site wage filing. IdentityRoles does not adjust for city, level beyond the title, or equity. Missing pay is missing: roles without a range are counted as open jobs and left out of medians.

How to cite

IdentityRoles, "IAM salary tracker," employer-posted median midpoint as of Oct 21, 2026: $167,850 (34 USD practitioner ranges, 14 companies). https://identityroles.com/salaries/. Method: https://identityroles.com/methodology/.

Use the date in the sentence you quote. Sample size is part of the figure. The hub is /salaries/.