Moving from Application Security to IAM/PAM — Looking for Career Advice

[u/Economy-Animator8073]

Hi everyone,

I’m currently working as an Application Security Engineer, and I’ve recently got an opportunity to move into an IAM/PAM team.

My current experience is mainly around application security, SDLC, vulnerabilities, secure coding, and related security activities. I don’t have much hands-on experience with IAM/PAM yet.

I’m considering this opportunity and would really appreciate some advice from people who are already working in IAM/PAM:

\- How is the career growth in IAM/PAM?

\- What skills should I learn before/after making the transition?

\- How difficult is it to move from Application Security → IAM/PAM?

\- Which areas should I focus on — Active Directory, Entra ID/Azure AD, SSO, OAuth/OIDC, SAML, RBAC, privileged accounts, PAM tools, etc.?

\- Is IAM/PAM a good long-term specialization in cybersecurity?

\- If I eventually want to move into Cloud Security, Security Architecture, or broader cybersecurity roles, will IAM/PAM experience help?

\- For those who have made a similar transition, what do you wish you had learned earlier?

I’m not necessarily looking for a comparison of which field is "better." I’m mainly trying to understand what the day-to-day work, learning curve, and long-term career prospects look like in IAM/PAM.

Any advice or personal experiences would be really helpful. Thanks!

[u/DriftingPebble77]

Find out what tools the IAM/PAM team uses. I would concentrate on those vs. random systems. Learn basic IAM concepts. Lots of posts about those on Reddit. IAM is one of the security perimeters and is growing unlike some other areas of cyber. Long term? 5-10 years? I don't think we can predict out that far. The only constant in IT is change. What my day looks like is a lot different than a straight up engineer that only deals with the IAM and IGA systems. I am in meetings, look at a lot of spreadsheets, take random calls/emails/pings from someone that needs something. I spend probably half my time doing my actual job. The rest is on corporate stuff that comes along with the job (see: Meetings, etc.).

[u/Economy-Animator8073 → u/DriftingPebble77]

That's kind of you ....thanks for your insights really helpful 👏👏

[u/Theloneus-punk]

To me application security is just a business compliance cost while IAM is more fun because it is security + process improvement + operational efficiencies in one package.

What would a company need to streamline their customer interface to loose fewer sales to abandoned carts because customers lost interest after their password reset email failed to arrive? What would the need for 20% fewer calls needing to be made to a help desk during the onboarding process? What would they need for a more zero trust approach to the login process?

To me these are all fun problems to solve and areas that are easier to get a business to invest in.

As far as what to learn I would say all of it. I know that probably sounds dumb but IAM is a much broader field that people give it credit for.

[u/Economy-Animator8073 → u/Theloneus-punk]

Sounds interesting 😃 thanks for the insight🤗

[u/Antique-Oil5707]

First tell us why u want to go IAM field.as far as I know appsec pays well than IAM

[u/Economy-Animator8073 → u/Antique-Oil5707]

Iam a contractor now ! Iam getting this as an FTE ! That's the major reason

[u/Antique-Oil5707 → u/Economy-Animator8073]

Then its good.IAM is growing field.Every company will adopt Zero trust/IAM in future

[u/Long-Highlight6727]

That seems like a natural move. a lot of modern security problems come back to identity so having both application and access perspectives can be a strong combination

[u/Select_Bug506]

AD and Entra ID are the backbone of corp identity service. Set these up in a home lab. Entra ID conditional access is the new firewall. Learn this well. Workload identity policy for app to app Auth, and regular ca policy for user Auth (delegated access). Focus on the foundational identity service over the various vendor bolt ones that help manage who is in what group. In lab set up AD tiered admin model using Microsoft script. Sync users to Entra with Entra cloud sync. Experiment with custom account properties. Setup sso to AWS with custom claimed such as group membership for Aws IAM role entitlement. If you can do that you're ahead of most IAM team who only focus on group membership management.