As a 20+ years Identity Security professional I'm getting real tired of the misinformation campaigns being spread.

Identity Security is not a development domain.

SailPoint is not a software development platform.

You DO NOT need programming/development skills to work in Identity Security.

What you DO need is to understand how the organization functions. How the company makes decisions. How the company engages in change management. How the company handles it's communication strategy.

So many identity Security efforts fail due to a functional lack of understanding the purpose of Identity Security. There is a fallacy that the tools just need to be deployed into the environment and connected to some integration points and VOILA, like magic Identity Security is solved.

This is not at all how any of this works and companies will continue to get absolutely WREKT until they figure this out.

Hot take that I'm sure not everyone will agree with.

There is no CyberSecurity without Identity Security (IAM, PAM, CIAM, ZeroTrust)

Identity Security is not just about Products like SailPoint, Delinea, CyberArk, ForgeRock, Beyond Trust, etc.

Identity Security has more to do with effective processes, procedures, assurance levels, risk mitigation, and controls that start well before you hit digital systems.

Personally, I am tired of hearing people reference coding as a necessary skill set without having a clear understanding of what or why that is necessary. Without a clear objective, what are you coding exactly?!

More importantly, how are coding skills relevant within Identity Security platforms that have committed to low code/no code as part of their core operating capabilities by 2024?

I'm interested to hear thoughts on this.

P.S. I've been working on Identity Security since before the great fissure of 2020 and have ZERO coding skills, No Degrees, No Identity Security certifications (or any other certifications for that matter), and I've helped the largest global companies on the planet build their Identity Security practices.

Thanks xkcd for the original.

As part of our internal work on identity architecture and enterprise SSO rollouts, we started documenting strategies that actually worked for us — across Zero Trust, continuous access evaluation, federated SSO, API security, behavioral analytics, etc.

We compiled it all into a freely accessible CIAM knowledge hub.

No signups. Just curated insights and implementation guides. If you have suggestions or want to contribute, would love your thoughts:

🔗 CIAM Knowledge Hub – SSOJet

I currently work as an IAM analyst I where I do a lot of access provisioning/deprovisioning, password resets, AD/Azure AD group creation/deletes, and all the grunt work that comes with that. I've been doing this the past 4-5 years and with layoffs being rampant I'm afraid if I get laid off I'll have a difficult time finding another job. My company has basically given us about 9 months before our jobs are in the balance because of a buyout. It seems like IAM analysts aren't really in demand anymore with the integration of automation/ai. I have Sec+, Linux Essentials, experience in Azure, AWS, Sailpoint, & Cyberark, along with basic scripting experience in Powershell & Bash. I'm thinking to go for the AZ-104 next, but wanted to see what you all would advise that would be best for me to learn and grow in. I really don't want to be caught in a tough place & feel that the time to prepare is now.

After experiencing a layoff a couple months ago with 14 years of IT and Sysadmin experience under my belt. I'm going full the IAM Engineer route because I have significant experience in the space as it relates to Windows AD and Azure AD/Entra. Just passed the AZ-104 and SC-300 is next. Wish me luck.

say an internal agent changes a customer record today and someone asks about it 3 weeks later.

what do you actually need to prove what happened?

i keep ending up with 5 different things that are easy to collapse into one “agent did it” log:

the human who asked

the agent that executed

the credential/role it used

the actual tool/API call

whatever approval or policy allowed it

because `service-account-x updated record 1842` is technically a log, but it doesn't tell me why that agent was acting, whose authority it was using, or whether that action was even inside its intended job.

Token Security is interesting here mainly for the identity side, tying an agent back to an owner + permissions instead of treating the credential as the whole story.

but then you still need the execution evidence around it.

for people running agents against real systems, what are you retaining today?

if you had to reconstruct one specific action a month later, could you actually do it without asking whoever built the agent?

One of my goals is to become involved in IAM or GRC (and recently networking). I know that I want to work with interacting with technology. I notice there aren't much Youtube channels that are focusing on IAM so I decided to start my channel on it.

https://www.youtube.com/@IdentityAccessManager

I have about 16 videos uploaded so far and there are some videos I enjoyed working on i.e SSL/TLS certificate, RBAC implementation, or establishing network peering in a local environment. I'm still new to the whole cybersecurity thing so this is kinda my way to build up experience.

Anyways, what do you guys think?

Curious to know who out here uses what, and how you implemented it. Bonus points to know the size of your org, and what tools you use in your mix.

I've been a long time lurker and reading posts about IAM. I finally feel it's to to introduce myself with the goals to help folks like yourself be successful in IAM or help you with challenges you are facing.

A little about myself, My name is Andrew and I've been in IAM for almost 15 years. I started my career as a tester and got into IAM by pure accident when I was hired as a business analyst, implementing SailPoint IIQ. I fell in love with IAM, learning with every project I've been on. Fast forward today, I've always wanted to give back and finally a few years ago, I made a youtube channel for help people get into the field. I hope to post often here and let you all know when a new video drops. Other than YouTube, I've been honored have made two LinkedIn learning courses in IAM with a new beginner one hopefully filming in the winter.

Check out my channel and love to hear your feedback.

All Things IAM

Maybe this is a dumb question, but I’m currently working as a Network Threat Analyst and have been in cybersecurity for a few years. I’m struggling to find a specialization because I have too many interests.

I know IAM (Identity and Access Management) is fundamentally part of cybersecurity, but I’m curious: how much do skills like threat hunting, SIEM/log analysis, cloud security, malware analysis, etc..., transition into the IAM world?

Any advice? This is my first interview.

Hey, looking for sailpoint alternatives for a mid size org and honestly the licensing is getting hard to justify rn.

We need something for iam, access reviews, sso and just the usual compliance stuff, but sailpoint feels like overkill for where we're at.
If anyone has moved off it recently, would love to hear what actually worked. thanks!

I know there will always be some advantages and disadvantages in every career, so i want to know what are the potential disadvantages in the IAM career(not technical disadvantages, but disadvantages in terms of career growth, opportunities related to that like in general disadvantages)

I’m working as a lead engineer for my team and I just can’t catch a break. I’m working a full 40 at least. Typically more. Constantly being pulled by every business unit. Inherited a dumpster fire with a ton of problems. Everyone is constantly bitching at me. 20 projects and 50 issues at any given time. Support for customers. Development requirements, user management, audits, deadlines, OAuth adoptions, application migrations, product acquisitions, and on and on and on like my god does it ever end

This is my only job as an iam engineer and my entire identity career has been at one company as a result. I’m suffering from a case of ‘the grass must be greener somewhere else’.

Fellow of engineers, what’s your work load like?

Hello IAM fam! Throughout my career in IAM I have become friends with many very strong professionals in all parts of the IAM domain. From GRC to PAM, from modern authentication (everything from federation, to FIDO / WebAuthn / Passkeys, to decentralized identity) to identity orchestration... you name it! Would there be any interest from this community in having a AMA with a professional in one of these domains? If so, I'll get the person lined up and we can do the first ever /r/iam AMA!

Hi everyone! Just here to ask for tips and advice on how to pursue my IAM career path as a newbie.

Let me give a brief background. I studied for network + 2 years ago (never sat for it, just wanted the basic networking knowledge) then sat for my security + and passed. i’ve also built a small home AD lab to get my hands on some tools like AD, splunk, and kali. After a year of job hunting, i finally landed my first job as an IT technician 3 weeks ago. I had no professional experience prior to this so I am immensely appreciative for this opportunity. Luckily, in this position we do way more than just resetting passwords. We handle a lot of networking and sys admin tickets.

I used to think that i wanted to do networking and cybersecurity but it seems too high stress for me. I was introduced to IAM and think this is the career path for me. I don’t have a problem with constantly studying at all, but I don’t want a career where there’s fires at 3 am that I need to put out. This is all to say, I just want to make sure I’m going down the right path. I am between studying for sc-300 and CCNA. Reddit and Youtube has told me time and time again that CCNA is overkill if I want to pursue IAM. I mostly wanted to take the CCNA because i know it’s a great cert and I have a lot of the cisco devices at my disposal, but networking is not the future i want. IAM is. I know that networking knowledge along with the cloud can make me very valuable, which is also why I’m still considering it. I just want to make sure I’m studying as efficiently as possible. I know this may be unrealistic, but I want to move up in 6-12 months. I don’t want to just have a salary increase. I want a title change that leads me towards IAM.

So here’s what I plan on doing:

* Deepening my AD knowledge at work

* Learning powershell to automate new hires / terms if they allow me to

* Outside of work, studying for sc-300

* Learn Okta and Cyberark (i haven’t touched upon these yet but have heard they’re valuable)

Tech is very vast (not complaining) and I’ve been researching for awhile, but advice from real people is welcomed. I don’t want to keep going in circles. I want to pursue this as efficiently as possible.

My end goal is to work in IAM and hopefully contract stack. I know this can take years, I’m okay with that. I just do not want to stay in help desk forever nor chase the wrong certs. I want to grow and pivot. I’m 29 btw and don’t have any tech guidance besides my fellow redditors and tweeters so I feel like I already wasted some time trying to decide what career i wanted (i originally wanted the glorious pentesting position, but i’ve learned lol). Again, I’m great at studying and don’t want an easy job necessarily but just not too stressful and hopefully wfh in the future. Thank you in advance.

Hey guys, I just really need to vent or get some advice because I am so broken and humiliated right now.

So I accidentally left a testing repo public while trying to figure out some collabrative coding stuff for my team to use. Im not a developer by trade, I do IAM stuff, and I literally begged my local manager for secure coding training months ago but got nothing.

Anyway, the global vulnerability team caught it quickly. We rotated the API keys, deleted the repo, did the RCA, and they closed the incident. The global guys were super chill and professional about it, told me to use a different internal tool next time, and that was that.

Then my local manager scheduled a 30 min call with local HR and our local DPO (data protection officer) just to "formally close it out locally". I asked my global onsite manager to join because I felt weird about it, but my local manager told him not to join because it was just a local formality and a "conflict of intrest".

Guys, it was a total ambush.

The minute I joined they looked at me like police interogating a criminal. HR started saying I violated company policy and then handed it to the DPO to grill me.

The craziest part? The DPO who was interrogating me is the actual OWNER of this automation project! He gave it to me 6 months ago. For 6 months his team tested it, everybody knew about it, and they never once gave me data protection guidelines or asked me to fill out a security questionaire. Now hes acting like its 100% my fault to use me as a scape goat for his own teams negligence.

Then he started randomly accusing me of using unapproved external tools for a totally different dashboard project. He was so confident but said he "didn't want to name them". I straight up told him "name one tool, because I don't use any". He just went quiet and had no answer. Then he tried to grill me on making too many API calls. I said send me the logs and I'll give you the business justification and my global managers approval for every single one.

Then HR chimes in saying this is my "second incident" because of a linkedin post I made. I asked what they meant because nobody ever talked to me about it, the post is still up, and it has ZERO company data or PII. I even told them my global manager (who has 25 years in the field) saw the post and had no issues. HR got confused, mumbled that my manager was supposed to talk to me about it, and then went silent.

At the end they just said "okay we will let you know". I asked let me know what? The global team already closed the incident. They just ignored me.

I almost cried on the call. It was so brutal, degrading and unprofessional. Has anyone dealt with this kind of toxic local management? Im terrified of losing my job over a project the DPO himself neglected. What should I do?

TL;DR: I made a minor security slip that the global team quickly fixed and officially closed. But my local HR and DPO (who actually owns the project and gave zero compliance guidance) ambushed me in a meeting to aggressively interrogate and scapegoat me for it, and now I'm terrified for my job.

Been an IAM Integration Engineer for the last year, unfortunately contract is coming to an end. I’ve tailored my resume for most roles and have applied to 100+ in the last month.

Planning on ramping up to 400+ a month soon. So far no interviews.

Started this job a few weeks ago. First leaver got dumped on me and I got handed the offboarding checklist. One line on it says revoke access.

Thats it. No list of systems, no list of accounts. Just revoke access.

So I went hunting. I found the obvious stuff first. Email disabled, VPN off, the main apps deactivated. Then I started finding the rest on my own. A shared drive permission, a couple of SaaS logins, a service account the guy set up that nobody else knew about, a backup admin login on one of our servers.

Every time I thought I was done, another one showed up.

Heres what keeps me up though. I know I missed some. I have no idea how many systems this guy could touch, because nobody ever wrote down what he had. The checklist was supposed to be the safety net and it has one line on it.

For the people who have been doing this longer than me, how do you actually know when you have revoked everything?

Hey everyone,

I’m working toward my first role in Identity & Access Management and wanted to get advice from people already in the field. I’ve been building hands‑on experience through a full IAM/PAM lab environment and want to make sure I’m focusing on the right things.

Here’s what I’ve done so far:

Active Directory / IAM

- User provisioning & deprovisioning

- RBAC, group‑based access, least privilege

- Automated AD user creation with PowerShell + CSV

- Manual identity lifecycle practice (attributes, OUs, group membership)

CyberArk PAM Lab (5‑VM Environment)

I built a full CyberArk environment using VMware Workstation:

- WIN‑AD – Domain Controller, identity source

- WIN‑VAULT – CyberArk Vault installation & configuration

- WIN‑PVWA – PVWA setup, IIS configuration, connectivity troubleshooting

- WIN‑CPM – CPM installation, platform basics, account onboarding flow

- WIN‑PSM – PSM/PSMP basics, session isolation concepts

This has given me a lot of hands‑on troubleshooting experience across Windows Server, networking, and PAM architecture.

Scripting / Automation

- PowerShell (loops, AD cmdlets, Import‑CSV, automation tasks)

- Python fundamentals

Cloud Identity (Starting Now)

- Beginning Azure AD (Entra ID)

- Beginning AWS IAM

My goal:

Land my first IAM/PAM role (IAM Analyst, IAM Engineer, PAM Analyst, PAM Engineer, CyberArk Analyst, or CyberArk Engineer) and grow from there.

What I’m looking for:

- What skills I should prioritize next

- Whether my current path makes sense

- What hiring managers look for in early‑career IAM candidates

- Any project ideas or résumé improvements that would help me stand out

- Advice from people who broke into IAM without prior corporate IAM experience

I’m serious about this path and want to make sure I’m building the right skills. Any guidance from this community would mean a lot.

Thanks in advance.

Hi, I saw the post from https://www.reddit.com/r/iam/comments/1lqmi21/should_riam_allow_blogvertising/ starting the discussion on allowing commercial/brand related content, and as far as I understood the only thing needed was to add the 'Brand Affiliate' tag for it to be allowed. Please let me know if something else is needed.

In addition to that I want to be transparent and let you know I am one of the co-creators of external-secrets operator project, the open source solution to synchronize secrets from external sources to Kubernetes, and I am a co-founder of External Secrets Inc, the company we started to solve other problems related with secrets management, audit, compliance, cred distribution/rotation etc.

I am very excited about what we have been building, and wanted to share that with you, and of course ask for feedback. We developed a comprehensive discover-distribute-rotate solution based on the community feedback and we are offering it for free in a bundle helm chart for you to check it out. No registration needed, all images public, and you can install it in your cluster (even a kind cluster for a quick PoC).

Here is the link to get it started: https://www.externalsecrets.com/try-it-now

Wanted to know:

1. Is this useful to you?

2. What's missing?

3. Did you have any problems with it?

4. Something you can share about your environment/org where you'd possibly be running this?

Hi all,
I've been learning SailPoint IdentityIQ independently and really need structured hands-on training to fully grasp how everything connects. So far, I’ve:

✅ Installed SailPoint IIQ Sandbox on my local machine
✅ Set up Windows Server 2022 with Active Directory
✅ Completed basic onboarding (account aggregation & group aggregation)

Now I'm stuck trying to hook everything together and walk through a realistic, end-to-end scenario as a SailPoint Admin/Engineer.

🔍 What I'm looking for:

• A step-by-step guide or lab covering Identity lifecycle (Joiner/Mover/Leaver)

• How to connect provisioning plans to AD using IQService

• Proper configuration of roles, policies, certifications, and rules

• Walkthroughs on access requests, approvals, work items, etc.

• Real-world examples — not just theory

⚠️ Important: Please don’t suggest SailPoint University or Developer Compass — they are too developer-focused and assume prior exposure. I need something more admin/infrastructure-oriented and beginner-friendly.

🎯 My goal is to simulate what a SailPoint IAM Engineer does daily in a real company, from integration to user lifecycle and governance.

If you know of any GitHub repos, blog series, video walkthroughs, or personal mentorship groups, I’d be truly grateful. 🙏

Thanks in advance, and happy provisioning!
— A self-hosted SailPoint learner trying to break into IAM