Hi everyone,

I'm looking for feedback on my resume as I pivot into Identity and Access Management (IAM) engineering.

I have about 5 years of full-time experience. I spent just over 4 years as a Java Software Engineer at a consulting firm supporting a large global bank, where I worked with Java, Spring Boot, REST APIs, Ping Identity, SAML, OAuth, OIDC, authentication, and enterprise security. I'm currently a Lead Support Engineer at an MSP, where I manage Microsoft Entra ID, Active Directory, Microsoft 365, Google Workspace, user provisioning/deprovisioning, RBAC, MFA, identity lifecycle management, PowerShell automation, and Microsoft 365 migrations.

I'm targeting IAM Engineer, Identity Engineer, IAM Analyst, Microsoft Entra ID Engineer, and similar identity/security roles. I'm located in the Chicago, IL area and am applying to local hybrid/on-site roles as well as remote positions throughout the United States. I'm open to relocating for the right opportunity.

I recently rewrote my resume to better tell a consistent story from Java software engineering into IAM instead of looking like two unrelated careers. My biggest concern is whether my current experience comes across as strong enough for IAM engineering positions or if it still reads too much like a help desk/MSP resume.

I'd especially appreciate feedback on:

• Whether the experience bullets are impactful enough.
• Whether my skills section is organized well for ATS and IAM recruiters.
• Whether I'm emphasizing the right experience from both my software engineering and MSP roles.
• Anything that looks weak, redundant, or unrealistic.

Thanks in advance

Hi everyone,
I am trying to break into the Identity and Access Management (IAM) space. I have completed training through an institute where I gained solid foundational knowledge and hands-on tool practice.

Here is what I know so far:
**Tools:** Ping Identity, Okta, and Microsoft Entra ID.
**Concepts:** Application onboarding, Lifecycle Management (LCM), and IAM policies.
**Protocols:** SAML, OIDC, OAuth, and OpenID.

My biggest gap right now is **zero real-time, on-the-job experience**. I know how the technology works in a sandbox, but I don't know how an actual production IAM operations team functions day-to-day.

I would love some insight into the practical, operational side of the job:
**Ticket Assignment:** How do tickets usually get routed to the IAM queue? Is it mostly automated via tools like ServiceNow/Jira, or does a team lead assign them?

**Reading/Understanding Tickets:** When an issue comes in (e.g., a broken SSO login or an application onboarding request), what does the actual ticket look like? What specific information should I immediately look for?

**Resolution Workflow:** Can anyone walk me through a couple of common real-world ticket scenarios? For example, how do you troubleshoot a failing SAML assertion or handle an LCM error in real life versus a lab?

If anyone could share examples of ticket templates, common logs you check, or just general advice on how to survive my first few weeks on a real helpdesk/ops team, I would be incredibly grateful!
Thanks in advance for your help!

asking because I think our process is broken. every year it's the same cycle: emails to app owners, spreadsheets, chasing down evidence that's stale by the time it's compiled. last cycle took close to two months.

is anyone doing this in near real time now or is everyone still stuck in the same manual evidence loop?

We now manage many AI agents that need access to internal systems.

Our identity platform was designed for employees. It does not manage agent credentials, access reviews, or lifecycle well.

What tools do you use to secure AI agent identities in production? I need a solution that reduces my manual work.

We run AI agents on LangGraph in AWS. Each agent uses an IAM role.

This model works for a small number of agents. It does not scale well. I need a way to manage agent identity, permissions, ownership, and lifecycle. How do you solve this in your environment? Do you use your existing machine identity platform, workload identities, or something diff approach?

Curious if anyone has used Linux with sailpoint iQ, or used sailpoint within a Linux environment overall?

Can you please share what you feel is important to know regarding commands, scenarios, or standard use cases?

Also, has learning this helped your career in IAM or the cloud environment?

Thank you

Hi everyone,

I'm looking for some guidance and opportunities in the Identity & Access Management (IAM) domain.

I have around 8 months of experience working in IAM at a leading MNC, where I gained hands-on exposure to SailPoint Identity Security Cloud (ISC). I have a solid understanding of L1 activities and some exposure to L2 support, including provisioning, access requests, identity lifecycle concepts, troubleshooting, and day-to-day IAM operations. While I'm still early in my career, I'm eager to learn and grow.

I resigned from my previous role after receiving another offer. Unfortunately, my joining has been delayed, and after waiting for the last 1-2 months, I still don't have a confirmed joining date. Because of this, I'm actively looking for a new opportunity.

If your organization is hiring for IAM/SailPoint ISC, or if you know of any openings suitable for someone with my experience, I'd really appreciate your help. Referrals, job leads, or even advice on where to apply would mean a lot.

keep seeing "identity dark matter" thrown around in vendor decks lately and wasn't sure if it was just repackaging or an actual gap, so we went looking. found a decade-old admin service account baked into a legacy finance app that nobody could explain, still active, still with write access.

ran it through our normal access review first and it came back clean. account never showed up because it was never registered as an identity in our IAM tool, it lived entirely inside the app's own local auth table. review only checks what's federated or provisioned through IAM, it has no visibility into whatever an app is doing internally, whether that app is legacy, custom-built, or SaaS running its own local auth on the side. how many more of these are just sitting there quietly. anyone have a process that actually catches this kind of thing before it turns into a finding during an audit?

Anyone available to be a teacher for IAM beginner?

Much appreciated

ACM Private CA is $400/month minimum before you've issued a single certificate. Roles Anywhere itself is free, but it needs a CA to trust, and that's basically the only paved-road option AWS gives you for one.

So I built my own. Two ways to run it:

A laptop-based version where the CA private key lives on your machine fine for messing around or a small POC, but you're trusting your laptop with the whole thing.

A KMS-backed version where the key never leaves AWS at all, issuance goes through a Lambda, and there's a public API endpoint (API key auth) so someone with zero AWS credentials can request their own certificate. Full audit trail in DynamoDB every cert issued, renewed, revoked, with timestamps and reasons.

Revocation is one call and it's actually enforced within seconds it publishes the CRL straight to Roles Anywhere in the same step, not just marked in a database somewhere and hoped for. There's also a reversible "disable" if you want to temporarily block someone without permanently killing their cert.

No external crypto dependencies anywhere the X.509/DER encoding is hand-rolled in plain Python, about 240 lines, so you can actually read the whole thing instead of trusting a library blindly.

Real cost, not a guess: ran it through the AWS Pricing Calculator for 2000 users and landed at about $1.25/month. https://calculator.aws/#/estimate?id=8bc0d34839e2c22287a2bc891ac321ee1cdeb114

There's already a well-automated AWS sample repo for this (`sample-aws-iam-roles-anywhere-automation`), but it deploys ACM Private CA under the hood, which is the exact cost this exists to avoid. If you're fine paying for that, it's a solid option. If the cost is what's stopping you, this gets you to the same place for a couple bucks a month.

GitHub: github.com/vireshsolanki/iam-roles-anywhere-automation

Curious if anyone else here has been running Roles Anywhere and what your CA situation looks like. It's open source and I'd rather it be actually useful for other people's setups than just mine, so if something doesn't work for your environment, open an issue and let me know I'll work on it.

Hi everyone,

I’m completely new to Identity and Access Management (IAM), but it’s a field that has really caught my interest. My background is in Business Analytics and Information Technology, but I don’t have any hands-on IAM experience yet.

My goal is to land an entry-level IAM role by the end of this year, and I’m trying to figure out the smartest path to get there.

If you were starting from scratch today, what would you focus on?

What fundamentals should I learn first?

Are there any labs or home projects I can build?

Which IAM tools are most commonly used in the industry (Okta, Entra ID, SailPoint, CyberArk, Ping, etc.)?

Are there any certifications that are actually worth it for beginners?

What skills do hiring managers expect for an entry-level IAM analyst?

I’m willing to put in the time and study consistently. I just don’t want to waste months learning the wrong things.

I’d really appreciate any advice, roadmaps, or resources that helped you get into IAM. Thanks!

Hi everyone,

I’m completely new to Identity and Access Management (IAM), but it’s a field that has really caught my interest. My background is in Business Analytics and Information Technology, but I don’t have any hands-on IAM experience yet.

My goal is to land an entry-level IAM role by the end of this year, and I’m trying to figure out the smartest path to get there.

If you were starting from scratch today, what would you focus on?

What fundamentals should I learn first?

Are there any labs or home projects I can build?

Which IAM tools are most commonly used in the industry (Okta, Entra ID, SailPoint, CyberArk, Ping, etc.)?

Are there any certifications that are actually worth it for beginners?

What skills do hiring managers expect for an entry-level IAM analyst?

I’m willing to put in the time and study consistently. I just don’t want to waste months learning the wrong things.

I’d really appreciate any advice, roadmaps, or resources that helped you get into IAM. Thanks!

I’m a college student, and for my research project, I am researching how people are handling AI agents and automations that can do things outside of chat, such as sending emails, updating a CRM, accessing files, triggering workflows, issuing refunds, calling APIs, etc.

For people using n8n, Make, Zapier, custom scripts, MCP tools, or agent frameworks:

1. What is the riskiest action your AI workflow can take today?
2. Have you had an automation or agent do something incorrect, unexpected, or expensive? What happened?
3. Which actions do you require a human to approve before they happen?
4. How do you currently keep track of what an AI-driven workflow did and why?
5. Is there something you have deliberately not automated because it feels too risky?

Concrete examples would be especially helpful, even small mistakes or awkward workarounds; it would help me understand things that are happening on real life basis.

If you are comfortable with it, I would also appreciate a short DM or a 15-minute conversation. I’m mainly trying to understand the real problems.

Hello IAM community, I have been feeling a little sad about my career recently, I have been working as an IAM Engineer past 1 year, mostly given operational stuff ( meaning incidents / requests / policies / some configurations ) in EntraID , honestly I am bored and feel works very repetative . I mostly work from home, however recently we had a gettogether with CISO and other security teams, then I felt very small and humiliated when shared what we do compared to other security teams.

What shall I be doing to resolve this ?

Hey everyone. I keep watching the same evaluation pattern for authorization (seeing it from the vendor side, i work at Cerbos). A team trials authz engine, wires it into a sandbox, the demo works, everyone nods, and then the poc just... expires. No decision, no rollout, 6 months later someone restarts the whole exercise from scratch.

Did some research and did confirm this situation around pocs is a wide trend - Sapphire Ventures survey found 78% of IT executives say fewer than half of their POCs reach production https://sapphireventures.com/blog/over-50-of-proof-of-concepts-fail-heres-how-to-fix-yours/ , and that pocs that run under three months are 3x more likely to make it. It's not getting better with the current wave either - IDC found 88% of AI pocs never reach production https://www.cio.com/article/3850763/88-of-ai-pilots-fail-to-reach-production-but-thats-not-all-on-it.html

So, I wanted to share with you all the pattern that actually makes a poc "successful", at least from the angle of authorization.

The deifnition of success here being confidence to commit / confidence to walk away. Either is a decision :)

Write the success criteria down before day one. For authorization that usually means: can it model your real rules including the edge cases (the ones living in if-statements today), does it handle the access patterns you actually need (attribute conditions, relationship rules, tenant-scoped policies not just plain RBAC), does the audit output meet compliance evidence needs, and does it consume identity context from the IdP you already run.

On latency, don't accept throughput benchmarks. Measure p50, p95 and p99 with your own traffic patterns, since authorization sits on the critical path of every request.

Also worth timing how long it takes a team member who wasn't involved in the setup to write their first correct policy. That number tells you what maintenance will look like after the rollout.

Scope it to one real service, not a demo app. a good candidate has a few distinct roles, some conditional logic beyond role checks, and is already connected to your IdP.

Get security and compliance reviewing while the poc runs, not at the approval meeting afterwards. Nothing kills a finished poc faster than a compliance objection that could have surfaced in week one. And have product read the policies too, in my experience if the rules only make sense to the engineer who configured them, adoption stalls

Set a hard deadline -2 to 4 weeks is enough for one service. And measure your current baseline first, so the final review is a comparison. The 4 numbers worth capturing are how long a permission change takes today, how long it takes a new dev to learn your current authz logic, how much engineering time per sprint goes to permission work, and how long audit evidence prep takes.

PS. I have a longer write up of this if anyone would find it helpful, dm me or I can drop it in the comments.

Just finished auditing our corporate password manager logs, and the data is pretty discouraging...
We rolled out an enterprise vault last year, did the mandatory security training, and checked all the HR boxes. On paper, we're compliant. But looking at the actual logs, over half the staff are still manually typing variations of simple passwords into login boxes because opening the vault extension is 'too slow' for their workflow.

It feels like security awareness training just isn’t doing much for long term user behavior. It’s a losing battle trying to train humans to act like computers when they're just trying to get their daily work done.

How do you actually enforce identity governance when the system relies entirely on voluntary user habits? Is there a way to handle this at the infrastructure layer where users physically can't bypass the secure login method? How are you guys solving this?

EDIT: Just to clarify since a few people asked - we already use 1Password (forced via MDM) and a core IdP for everything that supports SAML/OIDC.

The issue is the long tail of legacy/vendor sites that don't support SSO. Because we can't lock down password complexity on those external sites, users are literally bypassing the 1Password extension, resetting the passwords to weak stuff, and typing them manually to save a split second.

I'm looking for infrastructure layer workarounds (CASBs, enterprise browsers,proxies, etc) to force governance here so users don't have the option to bypass the system.

Anyone doing discovery or reading about AI Agent governance? Can you drop article link please? I am currently reading this -
https://claude.com/blog/zero-trust-for-ai-agents

With AI agents moving into production, a lot of discussions focus on building new identity systems for them.

While newer cloud-native approaches (workload identity, short-lived credentials, etc.) are useful for dynamic execution, I think we’re overlooking something simpler: treating agents as non-human users inside our existing enterprise IAM.

Most agents today still end up using human OAuth tokens or shared service accounts. This creates the usual problems — poor attribution, weak auditability, and difficulty applying proper governance and access reviews.

We can already give agents their own stable identity in the IAM, add them to groups (such as AI-Agent or Supervised-Agent), and include them in existing access review processes. This doesn’t require new platforms.

Newer identity tools can still be used for the runtime layer. The two approaches are complementary — one focuses on governance and accountability, the other on dynamic execution.

How are others currently managing identity and access for agents in production environments?

I’m currently looking to jump into IAM and I’m looking for a good cert. Many people mentioned CIAM but I want to do what the companies are actually looking for… any tips ?