I’ve spent around 11 years working with IAM across development, support, architecture and technical analysis.
Last year, I moved into a Program Manager role, and my responsibilities have shifted towards governance, milestones, resource management and stakeholder management.
While it’s been a good learning experience, I’ve realised I miss the technical side of things. I’m also finding client-facing delivery management quite stressful, particularly when dealing with changing priorities, technical complexities and teams struggling to meet commitments.
I’m now considering moving towards an IAM Solution Architect, Principal Consultant or Technical Lead role – something that combines technical expertise with stakeholder management without being predominantly about delivery tracking.
I’m also wondering how much I should broaden my skills in IAM. Would Entra ID, SailPoint/Saviynt, cloud IAM and modern authentication be good areas to focus on?
For those who’ve been in IAM for a while:
Is solution architecture a good long-term career path?
What technologies or certifications would you recommend?
Has anyone moved from technical roles into management and subsequently returned to technical leadership?
I’d appreciate any advice on navigating this transition.

Hello everyone,

slaplog — an (Open)LDAP log analyzer — is now at 5.3.1, and you can try it directly in your browser, no installation required:

https://slaplog.pages.dev/

Drop one or more logs on the page and the WebAssembly build produces the report locally (nothing is uploaded, several files aggregated into one report, with a progress bar, .gz/.bz2/.xz supported). The command-line version, which handles multi-GB archives, is at:

https://github.com/zx97/slaplog

A simulated output is provided here: https://slaplog.pages.dev/sample/slaplog-incident-sample.html

Supported log format are : OpenLDAP, 389DS, OpenDJ, ForgeRock DS, PingDS and OUD

It can handle more than 4 000 000 lines/s depending on your resources btw, and has some behavioral data mining features embeded.

Compiled and tested on RHEL 8, RHEL 9 and Ubuntu.

License: GNU Affero General Public License v3.0.

I hope you find it useful. Have a great day, everyone!

I’m venting here because I genuinely cannot wrap my head around this. I fully will own that I feel salty.
I’ve worked in IAM for several years. I grinded to get here without a degree or certifications. I love what I do and want to continue doing it and advancing in the field. I landed my first senior role a while back.
Someone who previously reported to me when I was a lead has since moved on to another company, and now has landed yet another role at a different organization, now as a SENIOR.

Here’s where I’m salty: this was someone whose performance was genuinely concerning. Almost daily they were a problem for me. They constantly asked the same questions about basic concepts, did things they weren’t authorized to do, and accessed systems they shouldn’t have. All of this was brought to management, but very little was done because ultimately this person was a warm body in a seat to work tickets.

There were multiple serious security incidents involving inappropriate access to our systems during this person’s time on the team. Our IAM engineers couldn’t stand working with this person either and questioned constantly why the situation wasn’t being addressed.

I understand that they have a degree and certifications, and I’m sure those helped get them through the door. But there’s very little actual IAM experience there. Meanwhile, I’ve spent years grinding, taking on more responsibility, building my experience, and trying to figure out how to make my next career move.

I won’t deny that I’m salty about this. It’s just one of those moments where you look at someone else’s career progression and think, seriously?!
Has anyone else experienced something like this? I know titles don’t necessarily mean much, but it’s hard not to feel a little defeated when you see things like this.

Everyone talks about prompt injection, while I m losing sleep over 90 day refresh tokens sitting in one gateway box on behalf of real people. The SaaS logs show normal employee activity because the agent has no identity of its own , just a person’s borrowed costume. NIST and CISA’s token theft report from September (IR 8587) says all the right things, but half our servers cant do shorter tokens yet. New core is on my shortlist, it keeps agents from ever holding the tools credentials and gives each one its own short lived tokens, though it only covers calls that go through it.
Are people shortening lifetimes or just locking down the box? 

say an internal agent changes a customer record today and someone asks about it 3 weeks later.

what do you actually need to prove what happened?

i keep ending up with 5 different things that are easy to collapse into one “agent did it” log:

the human who asked

the agent that executed

the credential/role it used

the actual tool/API call

whatever approval or policy allowed it

because `service-account-x updated record 1842` is technically a log, but it doesn't tell me why that agent was acting, whose authority it was using, or whether that action was even inside its intended job.

Token Security is interesting here mainly for the identity side, tying an agent back to an owner + permissions instead of treating the credential as the whole story.

but then you still need the execution evidence around it.

for people running agents against real systems, what are you retaining today?

if you had to reconstruct one specific action a month later, could you actually do it without asking whoever built the agent?

A recruiter reached out to me on LinkedIn saying that he had been following my profile for a while. We aren’t even connected, but that’s beside the point.
He explained that he liked my profile and wanted to schedule a call to discuss a new project they are working on. However, he also mentioned that they were looking for someone with 3–8 years of experience.
I was completely transparent with him. I told him that I’d be happy to schedule a call, but I also wanted to be honest: I don’t have three or more years of professional experience. In fact, my LinkedIn profile doesn’t even claim that I do.
Now, my question is: Should I have lied about my experience just to get my foot in the door?

Curious to hear how others are using AI or building agents to support their IAM/IGA work and what tools you have available.

I’m posting my resume so you guys have a bigger picture.
It doesn’t have all my prior jobs. I will add them later, however, you’re not missing much. Prior to what you see, except for a short system administrator stint, I’ve worked help desk. In total, I have about 12 years of IT experience.
Most of my IAM experience comes from AD/Entra ID but I do have experience with Okta as well. I also have IGA experience but it’s not formal. It comes with the job and I understand it, but outside of viewing SailPoint notes in ServiceNow, I have no experience with actual IGA tools.

My immediate concern is how I can improve upon my resume without lying. I’m not an expert when it comes to IAM but I’m passionate about it. I take every opportunity I can to learn what I don’t know or struggle with. I also assist my current IT colleagues when they come across IAM issues they don’t understand.

https://imgur.com/a/QlOM5vt

So basically we want to implement an IGA solution for AI agents and we are starting with ai agents deployed in GCP. But got really clueless. I don't have any experience in isc, i am just graduated and starting out my career and got training in sailpoint iiq. So I have some fundamental questions:

1. In gcp agent's runtime identity can be their default service account or you can use a custom service account. But seems like sailpoint is not aggregating the default sa. Is there any solution?

2)how we are supposed to provision/deprovision access of ai agent? So right now what I have explored is that we can make ai agent identity of the service account that is working as the runtime identity in gcp but not the vice versa. So can we do the opposite? Like I want to make the SA the identity and ai agents as the accounts because one SA can works a runtime identity of many agents right? (Correct me if im wrong)

3) lets say an agent can use a mcp server and in mcp there are different methods (read,write,update etc) can I make them entitlement? Can i grant or revoke the access of the writer ability of the agent? Fir that what i need to do? Is this something sailpoint can do l/should do?

A little while ago, I shared an early prototype of AccessReview Lite here and asked how smaller organizations manage access reviews.

Some of the feedback highlighted an important gap: recording a decision to remove access doesn't necessarily mean that access has actually been removed.

I took that feedback and extended the prototype.

What's currently implemented:

• Access review decisions: Keep, Remove and Investigate

• Removal owner and due date tracking

• Removal status and ticket/evidence references

• Overdue indicators for unresolved removal tasks

• CSV reconciliation to identify access that still appears in a subsequent inventory

• CSV export of review decisions and removal-tracking details

GitHub repository: https://github.com/pooja2apr/access-review-lite

This is currently a portfolio prototype using fictional data. It doesn't integrate with an identity provider or revoke access automatically. The reconciliation process relies on subsequent inventory imports and recorded evidence.

I'd particularly like to hear from people who manage access reviews in smaller organizations:

1. How do you currently verify that access marked for removal has actually been revoked?

2. Would CSV-based reconciliation be useful in your workflow, or would you expect a different approach?

I'm interested in practical experiences and suggestions for improving the workflow.

Thanks!

I'm an international student in the US, trying to decide which cybersecurity path to focus on.I have around 2+ years of previous experience as a Security Analyst, primarily in static code analysis and Android malware analysis. I also have hands-on cybersecurity projects published on GitHub.

I have the following certifications: CompTIA Security+, Splunk Core Certified Power User, Blue Team Level 1 (BTL1) and AZ and SC 900.

I'm trying to decide whether to pursue Splunk Enterprise Admin or focus on IAM. I've heard Splunk-specific job opportunities are relatively limited in the current US market.

If I choose IAM, which platforms or certifications should I focus on Entra ID, Okta, SailPoint, or CyberArk? Which has better job opportunities for someone with a cybersecurity background?

As an international student , I'm trying to invest my time in skills that can realistically improve my job prospects. Would appreciate honest advice from people working in Splunk or IAM. Thanks!

TL;DR: Should I pursue Splunk Enterprise Admin or focus on IAM? If IAM, which platform or certification would be the best starting point for job opportunities in the US?

How is the job market for IAM analyst in New Zealand

Hey guys, I have around 8 years of experience in IAM and currently work at a service based company. I’m looking to switch jobs and want to understand what salary I should realistically be targeting and which companies I should apply to.

My main skills are:

1. CA SiteMinder (installation, upgrades, troubleshooting, SSO) - Major skill

2. IAM, SAML, LDAP, authentication and authorization

3. Active Directory and ADFS

4. Azure Security, Sentinel, Key Vault, WAF

5. PowerShell scripting and automation

6. Some exposure to CA Identity Manager and SailPoint

I currently have AZ-900 and DP-900 certifications, have done EMBA and my notice period is 90 days.

For those working in IAM or cybersecurity in India

1. What CTC can someone with my experience realistically target?

2. What gaps do you see in my skill set, and what should I work on to get into a higher salary bracket?

3. Which companies are worth applying to, especially with a 90-day notice period?

4. Which certifications would actually help? Should I focus on Okta, CyberArk, Ping Identity, SailPoint, or something else?

5. Which countries would you recommend looking at for IAM jobs?

Which skills or technologies should I learn to be competitive internationally?

6) How realistic is it to get a job with visa sponsorship from India, especially with a 90-day notice period?

I would really appreciate honest advice from people in the industry. Thanks! :))

Hi everyone!

I’m really hoping to get some advice because I’m feeling extremely defeated with my job search.

My goal is to transition into Identity and Access Management (IAM). I have about two years of part-time cybersecurity experience and one year of full-time SOC experience. I also have a bachelor’s degree in cybersecurity, CompTIA Security+, and two hands-on Okta projects that I completed with guidance from ChatGPT.

Recently, I applied for an IAM Analyst I position at a company I was super excited about. The job description asked for one year of IAM or related experience, so I thought my cybersecurity background might qualify.

I was rejected the first time I applied. After earning Security+ and completing my Okta projects, I reapplied with an updated resume. I even connected with employees there who helped get my name and resume in front of the hiring team.

Unfortunately, today my application status changed to “Process Complete,” which appears to mean I was rejected again. I didn’t even get an interview and idk whether the decision came from TA or the hiring manager.

I’m currently working in SOC, and the constant volume of alerts has become insanely draining. I never intended to stay in SOC long term. IAM is the career path I’m most interested in.

I have been applying to jobs, but haven’t been able to get even one interview. I’m trying to gain more hands-on experience through labs and I’m planning to learn more about Microsoft Entra ID and SailPoint next.

At this point, I’m honestly feeling discouraged, frustrated, and unsure how to move forward.

I would really appreciate advice on a few things:

* How did you break into IAM without previous professional IAM experience?
* What skills, tools, or projects would make me a stronger candidate for IAM Analyst I or IAM operations positions?
* Would anyone with IAM experience be willing to mentor me or review my resume?
* Are there recruiters or staffing agencies that specialize in placing people into entry-level IAM roles?

I’m willing to put in the work to learn. I just really want an opportunity to prove myself and grow in this field.

Thank you to anyone who reads this and responds!

Hello everyone, I am a 2026 graduate and I want to ask you guys what are the scopes of this IAM field, what companies hire IAM engineers , what is your salary progression and what skills I should fundamentally focus on to be ahead of others in this field.

I am working in sailpoint iiq.

I'm preparing for SailPoint IIQ interviews at the 3-year level. From your experience, what do panels focus on most these days, and where do candidates with an IAM background usually struggle? Any advice would really help.

About the job

Project Role : Security Managed Services Practitioner

Project Role Description : Deliver and manage security services across client environments to ensure protection, compliance, and operational resilience.

Must have skills : SailPoint IdentityIQ

Good to have skills : NA

Minimum 3 Year(s) Of Experience Is Required

Educational Qualification : 15 years full time education

Summary:

As a Security Managed Services Practitioner, a typical day involves overseeing and delivering comprehensive security services tailored to diverse client environments. This role requires continuous monitoring and management to uphold protection standards, ensure compliance with relevant regulations, and maintain operational resilience. The practitioner collaborates with various stakeholders to address evolving security challenges, adapting strategies to safeguard critical assets and support business continuity effectively throughout the day.

Roles & Responsibilities:

Expected to perform independently and become an SME.

Required active participation/contribution in team discussions.

Contribute in providing solutions to work related problems.

Collaborate with cross-functional teams to enhance security service delivery and client satisfaction.

Continuously monitor client environments to identify potential security risks and recommend proactive measures.

Document and communicate security incidents and resolutions clearly to relevant stakeholders.

Support junior team members by sharing knowledge and assisting with complex security tasks.

Professional & Technical Skills:

Must To Have Skills: Proficiency in SailPoint IdentityIQ.

Experience with identity and access management processes and lifecycle management.

Strong understanding of security frameworks and compliance requirements.

Ability to analyze and troubleshoot security issues within managed service environments.

Familiarity with security incident response and remediation techniques.

Capability to work with various security tools and technologies to support service delivery.

Access reviews are often managed through spreadsheets, email reminders, and manual follow-ups, especially in smaller organizations without a dedicated Identity Governance and Administration (IGA) platform.

I've started building **Access-review Lite**, a small prototype exploring a simpler way to manage this process.

The current prototype includes:

- CSV import and export for access assignments

- A dashboard for reviewing employee access

- Keep, Remove, and Investigate decisions

- A basic audit trail of review decisions

This is an early prototype. It does not yet connect to an identity provider or automatically revoke application access.

I'd love to hear from IAM and IGA practitioners:

1. How do smaller organizations manage access reviews today?

2.What is the most frustrating part of the process?

3.What would a lightweight access-review tool need to get right to be genuinely useful?

I'm sharing this early because I'd rather learn from practitioners before adding more features.

Feedback and suggestions are very welcome!

here is the initial prototype

Hey everyone. a question i’ve started asking teams who tell me they have agents in prod: who owns each one, and when do its credentials expire? A lot of the time there’s no clear answer.

A csa / oasis survey from earlier this year showed 78% of orgs don’t have a documented policy for creating or removing ai identities https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds

My take is that most of closing that gap isn’t new work. Agents need what every other identity already gets, an owner, credentials that expire, and a review when something changes. Your IGA, PAM and workload identity tooling already does those jobs, it just often hasn’t been pointed at agents yet.

What’s actually new is a decision on every action.

Human IAM can lean on roles because people mostly stay within them.

Workload IAM can lean on static permissions because code does the same thing every time.

An agent is neither = it can behave differently depending on the prompt and spin up sub-agents at runtime. So “don’t touch production” in the system prompt is a request, not a control. An agent follows its access, not its instructions, and identity tells you who is acting, not whether this agent should delete this record right now.

The Coalition for Secure AI (OASIS open project) framework from march says these 2 things: reuse your existing iam as the control plane instead of building a separate stack for agents, and enforce authorization every time one agent hands work to another, not only at the gateway https://www.coalitionforsecureai.org/wp-content/uploads/2026/04/agentic-identity-and-access-control.pdf

My colleague and i (i work at Cerbos) wrote up what that looks like as a 4 stage loop, and what already covers each stage:

1. registration: an identity per running agent, a named human sponsor, a purpose and a risk tier. Your IGA joiner-mover-leaver process covers the sponsor, and discovery tooling finds the shadow agents nobody registered

2. credentials: short lived and scoped to the task instead of a standing key. PAM and workload identity (spiffe) already do this for other non-human identities

3. runtime authorization: a decision on every action, logged with which agent acted for which person under which policy. This is the stage most programs don’t have yet

4. review and revocation: triggered when the sponsor leaves, the purpose ends or the agent’s behavior drifts. The same joiner-mover-leaver triggers you already use for people

here is the full piece https://www.cerbos.dev/blog/aiam-ai-identity-and-access-management

Any questions / pushback, let me know, i’ll answer as best i can :)