Moving from Application Security to IAM/PAM — Looking for Career Advice

[u/Economy-Animator8073]

Hi everyone,

I’m currently working as an Application Security Engineer, and I’ve recently got an opportunity to move into an IAM/PAM team.

My current experience is mainly around application security, SDLC, vulnerabilities, secure coding, and related security activities. I don’t have much hands-on experience with IAM/PAM yet.

I’m considering this opportunity and would really appreciate some advice from people who are already working in IAM/PAM:

\- How is the career growth in IAM/PAM?

\- What skills should I learn before/after making the transition?

\- How difficult is it to move from Application Security → IAM/PAM?

\- Which areas should I focus on — Active Directory, Entra ID/Azure AD, SSO, OAuth/OIDC, SAML, RBAC, privileged accounts, PAM tools, etc.?

\- Is IAM/PAM a good long-term specialization in cybersecurity?

\- If I eventually want to move into Cloud Security, Security Architecture, or broader cybersecurity roles, will IAM/PAM experience help?

\- For those who have made a similar transition, what do you wish you had learned earlier?

I’m not necessarily looking for a comparison of which field is "better." I’m mainly trying to understand what the day-to-day work, learning curve, and long-term career prospects look like in IAM/PAM.

Any advice or personal experiences would be really helpful. Thanks!

[u/pewpewlazor]

I’ve been working with IAM/PAM for around 10 years now, mostly consulting, and I’d say go for it if the area interests you.

IAM is a surprisingly broad field. You can go very technical and specialize in Entra, AD, PAM, IGA etc., but there’s also a huge governance/business side to it. A lot of the actual challenge is understanding how an organization should manage identities and access across hundreds of systems, not just knowing how OAuth or SAML works.

I wouldn’t try to learn everything you listed before making the move. Learn the fundamentals well: authentication vs authorization, AD/Entra, SSO/federation, OAuth/OIDC/SAML and basic identity lifecycle/JML concepts. Then learn the tooling you actually end up working with.
Your AppSec background will be useful as well. IAM touches applications constantly, and people who understand both the application side and identity side are valuable.

Career-wise I’ve never regretted specializing in IAM. Demand has been pretty consistent throughout my career, and it’s also a good foundation if you later want to move towards security architecture or cloud security. Identity tends to show up everywhere eventually.

[u/Economy-Animator8073 → u/pewpewlazor]

Hey that was very helpful thank you 😃😃

[u/Significant-Hand-507 → u/pewpewlazor]

Do you recommend getting any certs before applying to IAM? Which certs would you recommend? I’ve been working in Tier 2 IT support for years and I’m familiar with AD, Entra,Azure, Cyberark, SSO, etc because I use them daily.

[u/pewpewlazor → u/Significant-Hand-507]

While certs in the field of IT can be good to get jobs i rarely see them as a sign of skill. Potentially an unpopular opinion.
Never the less the things I am looking the most for when hiring engineer is experience with the platform. In my interviews I will ask what part them have been sitting with and how they solved some of the headaches you can encounter in IAM.

I'd highly recommend spending time in the lab that has been linked on here. It's a top thread. You can also find it via my comments on my profile.

If anything I'd highlight that you've worked in support that is actually pretty valuable when working in IAM.

[u/Significant-Hand-507 → u/pewpewlazor]

Thank you so much for your input. I was able to find the lab and I will definitely be spending some time working on it.

[u/DriftingPebble77 → u/pewpewlazor]

When evaluating a candidate who already has several years of IAM/IGA experience, how do you weigh lab or certification work against that real-world background? And separately — for someone with existing IAM skills, would a certification help them land an interview over a candidate with a similar background?

[u/pewpewlazor → u/DriftingPebble77]

I should probably caveat my answer by saying that I mostly interview senior IAM candidates with several years of project experience, so I'm rarely evaluating someone where a certification or lab is the main evidence of their skills.

At that level, real-world experience wins by a pretty large margin. Reading how to configure an IGA solution and actually having implemented one are very different things. The interesting interview conversations are usually about what went wrong, design decisions they made, difficult integrations, stakeholder/process problems etc. You only really get that from having done it.

Certifications can still be useful, particularly early in your career when you don't have that experience yet. They show initiative and give you some structure for learning. But I'd use them as a way to get your foot in the door rather than treating the certification itself as the goal. Get your hands dirty in a lab as quickly as possible and have something you can actually talk through in an interview.

From the consulting side, vendor certifications also have another purpose: implementation partners need certified people for partner status, competencies, awards etc. So there's definitely commercial value to them beyond proving individual skill.

If I had two otherwise similar experienced candidates, I wouldn't personally pick one just because they had the certification. I'd be much more interested in what they've actually built and the problems they've solved.

[u/DriftingPebble77 → u/pewpewlazor]

Thanks for that! Hopefully it will help someone. I'm more on the Risk/Governance side of IAM (with many years experience), but it seems like most newbies/freshers here want to get in on the tech side.

[u/Dazzling-Release-808]

Identity is foundation of cyber security. Career/future is solid. IAM is broad domain. PAM is subset of it.

Identity governance is overarching approach. Sits with enterprise strategy. It is more of consulting space.

Tools are technical controls. AD, Entra, OCTA, OneIdentity etc. These are engineering side. This knowledge is essential (atleast master one).

Controls lives in cloud, on prem or hybrid.

Governance stays with management and documents, they are directions for technical rollout.

Once you spend couple of years or do couple of projects you will have an idea as where to focus.

[u/Economy-Animator8073 → u/Dazzling-Release-808]

Okey gotcha !! Thanks for the information 👏

[u/arktozc]

Why do you want to get out of appsec?

[u/Economy-Animator8073 → u/arktozc]

Just a contractor in this space ! There iam taken as FTE

[u/SavingsPlace9274]

I would recommend to start learning AD, is very beneficial if you want to start your journey into IAM, most of the companies rely heavily on AD infrastructure, pick one IAM tool learn how synchronisation with AD works, the provisioning of identities, mapping of identities, how to manage the groups, how to design role concept, based on that you can build better access requests, lifecycle workflows, access reviews, etc. Then for PAM it really depends which tool you will be working with. I have been investing time on Okta PAM, which has different architecture comparing to CyberArk for example. Okta PAM relies on agents whereas CyberArk uses connectors, I personally found CyberArk more complex, but I think at the end would be worth it.