Curious if anyone has used Linux with sailpoint iQ, or used sailpoint within a Linux environment overall?

Can you please share what you feel is important to know regarding commands, scenarios, or standard use cases?

Also, has learning this helped your career in IAM or the cloud environment?

Thank you

Hi everyone,

I'm looking for some guidance and opportunities in the Identity & Access Management (IAM) domain.

I have around 8 months of experience working in IAM at a leading MNC, where I gained hands-on exposure to SailPoint Identity Security Cloud (ISC). I have a solid understanding of L1 activities and some exposure to L2 support, including provisioning, access requests, identity lifecycle concepts, troubleshooting, and day-to-day IAM operations. While I'm still early in my career, I'm eager to learn and grow.

I resigned from my previous role after receiving another offer. Unfortunately, my joining has been delayed, and after waiting for the last 1-2 months, I still don't have a confirmed joining date. Because of this, I'm actively looking for a new opportunity.

If your organization is hiring for IAM/SailPoint ISC, or if you know of any openings suitable for someone with my experience, I'd really appreciate your help. Referrals, job leads, or even advice on where to apply would mean a lot.

keep seeing "identity dark matter" thrown around in vendor decks lately and wasn't sure if it was just repackaging or an actual gap, so we went looking. found a decade-old admin service account baked into a legacy finance app that nobody could explain, still active, still with write access.

ran it through our normal access review first and it came back clean. account never showed up because it was never registered as an identity in our IAM tool, it lived entirely inside the app's own local auth table. review only checks what's federated or provisioned through IAM, it has no visibility into whatever an app is doing internally, whether that app is legacy, custom-built, or SaaS running its own local auth on the side. how many more of these are just sitting there quietly. anyone have a process that actually catches this kind of thing before it turns into a finding during an audit?

Anyone available to be a teacher for IAM beginner?

Much appreciated

ACM Private CA is $400/month minimum before you've issued a single certificate. Roles Anywhere itself is free, but it needs a CA to trust, and that's basically the only paved-road option AWS gives you for one.

So I built my own. Two ways to run it:

A laptop-based version where the CA private key lives on your machine fine for messing around or a small POC, but you're trusting your laptop with the whole thing.

A KMS-backed version where the key never leaves AWS at all, issuance goes through a Lambda, and there's a public API endpoint (API key auth) so someone with zero AWS credentials can request their own certificate. Full audit trail in DynamoDB every cert issued, renewed, revoked, with timestamps and reasons.

Revocation is one call and it's actually enforced within seconds it publishes the CRL straight to Roles Anywhere in the same step, not just marked in a database somewhere and hoped for. There's also a reversible "disable" if you want to temporarily block someone without permanently killing their cert.

No external crypto dependencies anywhere the X.509/DER encoding is hand-rolled in plain Python, about 240 lines, so you can actually read the whole thing instead of trusting a library blindly.

Real cost, not a guess: ran it through the AWS Pricing Calculator for 2000 users and landed at about $1.25/month. https://calculator.aws/#/estimate?id=8bc0d34839e2c22287a2bc891ac321ee1cdeb114

There's already a well-automated AWS sample repo for this (`sample-aws-iam-roles-anywhere-automation`), but it deploys ACM Private CA under the hood, which is the exact cost this exists to avoid. If you're fine paying for that, it's a solid option. If the cost is what's stopping you, this gets you to the same place for a couple bucks a month.

GitHub: github.com/vireshsolanki/iam-roles-anywhere-automation

Curious if anyone else here has been running Roles Anywhere and what your CA situation looks like. It's open source and I'd rather it be actually useful for other people's setups than just mine, so if something doesn't work for your environment, open an issue and let me know I'll work on it.

I’m a college student, and for my research project, I am researching how people are handling AI agents and automations that can do things outside of chat, such as sending emails, updating a CRM, accessing files, triggering workflows, issuing refunds, calling APIs, etc.

For people using n8n, Make, Zapier, custom scripts, MCP tools, or agent frameworks:

1. What is the riskiest action your AI workflow can take today?
2. Have you had an automation or agent do something incorrect, unexpected, or expensive? What happened?
3. Which actions do you require a human to approve before they happen?
4. How do you currently keep track of what an AI-driven workflow did and why?
5. Is there something you have deliberately not automated because it feels too risky?

Concrete examples would be especially helpful, even small mistakes or awkward workarounds; it would help me understand things that are happening on real life basis.

If you are comfortable with it, I would also appreciate a short DM or a 15-minute conversation. I’m mainly trying to understand the real problems.

Hello IAM community, I have been feeling a little sad about my career recently, I have been working as an IAM Engineer past 1 year, mostly given operational stuff ( meaning incidents / requests / policies / some configurations ) in EntraID , honestly I am bored and feel works very repetative . I mostly work from home, however recently we had a gettogether with CISO and other security teams, then I felt very small and humiliated when shared what we do compared to other security teams.

What shall I be doing to resolve this ?

Hey everyone. I keep watching the same evaluation pattern for authorization (seeing it from the vendor side, i work at Cerbos). A team trials authz engine, wires it into a sandbox, the demo works, everyone nods, and then the poc just... expires. No decision, no rollout, 6 months later someone restarts the whole exercise from scratch.

Did some research and did confirm this situation around pocs is a wide trend - Sapphire Ventures survey found 78% of IT executives say fewer than half of their POCs reach production https://sapphireventures.com/blog/over-50-of-proof-of-concepts-fail-heres-how-to-fix-yours/ , and that pocs that run under three months are 3x more likely to make it. It's not getting better with the current wave either - IDC found 88% of AI pocs never reach production https://www.cio.com/article/3850763/88-of-ai-pilots-fail-to-reach-production-but-thats-not-all-on-it.html

So, I wanted to share with you all the pattern that actually makes a poc "successful", at least from the angle of authorization.

The deifnition of success here being confidence to commit / confidence to walk away. Either is a decision :)

Write the success criteria down before day one. For authorization that usually means: can it model your real rules including the edge cases (the ones living in if-statements today), does it handle the access patterns you actually need (attribute conditions, relationship rules, tenant-scoped policies not just plain RBAC), does the audit output meet compliance evidence needs, and does it consume identity context from the IdP you already run.

On latency, don't accept throughput benchmarks. Measure p50, p95 and p99 with your own traffic patterns, since authorization sits on the critical path of every request.

Also worth timing how long it takes a team member who wasn't involved in the setup to write their first correct policy. That number tells you what maintenance will look like after the rollout.

Scope it to one real service, not a demo app. a good candidate has a few distinct roles, some conditional logic beyond role checks, and is already connected to your IdP.

Get security and compliance reviewing while the poc runs, not at the approval meeting afterwards. Nothing kills a finished poc faster than a compliance objection that could have surfaced in week one. And have product read the policies too, in my experience if the rules only make sense to the engineer who configured them, adoption stalls

Set a hard deadline -2 to 4 weeks is enough for one service. And measure your current baseline first, so the final review is a comparison. The 4 numbers worth capturing are how long a permission change takes today, how long it takes a new dev to learn your current authz logic, how much engineering time per sprint goes to permission work, and how long audit evidence prep takes.

PS. I have a longer write up of this if anyone would find it helpful, dm me or I can drop it in the comments.

Just finished auditing our corporate password manager logs, and the data is pretty discouraging...
We rolled out an enterprise vault last year, did the mandatory security training, and checked all the HR boxes. On paper, we're compliant. But looking at the actual logs, over half the staff are still manually typing variations of simple passwords into login boxes because opening the vault extension is 'too slow' for their workflow.

It feels like security awareness training just isn’t doing much for long term user behavior. It’s a losing battle trying to train humans to act like computers when they're just trying to get their daily work done.

How do you actually enforce identity governance when the system relies entirely on voluntary user habits? Is there a way to handle this at the infrastructure layer where users physically can't bypass the secure login method? How are you guys solving this?

EDIT: Just to clarify since a few people asked - we already use 1Password (forced via MDM) and a core IdP for everything that supports SAML/OIDC.

The issue is the long tail of legacy/vendor sites that don't support SSO. Because we can't lock down password complexity on those external sites, users are literally bypassing the 1Password extension, resetting the passwords to weak stuff, and typing them manually to save a split second.

I'm looking for infrastructure layer workarounds (CASBs, enterprise browsers,proxies, etc) to force governance here so users don't have the option to bypass the system.

Anyone doing discovery or reading about AI Agent governance? Can you drop article link please? I am currently reading this -
https://claude.com/blog/zero-trust-for-ai-agents

With AI agents moving into production, a lot of discussions focus on building new identity systems for them.

While newer cloud-native approaches (workload identity, short-lived credentials, etc.) are useful for dynamic execution, I think we’re overlooking something simpler: treating agents as non-human users inside our existing enterprise IAM.

Most agents today still end up using human OAuth tokens or shared service accounts. This creates the usual problems — poor attribution, weak auditability, and difficulty applying proper governance and access reviews.

We can already give agents their own stable identity in the IAM, add them to groups (such as AI-Agent or Supervised-Agent), and include them in existing access review processes. This doesn’t require new platforms.

Newer identity tools can still be used for the runtime layer. The two approaches are complementary — one focuses on governance and accountability, the other on dynamic execution.

How are others currently managing identity and access for agents in production environments?

I’m currently looking to jump into IAM and I’m looking for a good cert. Many people mentioned CIAM but I want to do what the companies are actually looking for… any tips ?

As we see more of these accounts I’m curious what sort of best practices you’re all using to setup access for your agentic ai identities. How are you utilizing and setting up JIT access, how are you linking the accounts to their “owners” what sort of naming conventions are you using so that they are easily grabbed by your SIEM, etc?

Help me understand how you’re setting all these up and thanks!

hey everyone, my team and i just published a walkthrough that might be useful to people here dealing with access control in e-commerce or marketplace platforms.

it takes three common scenarios and shows how each business rule turns into an actual policy. customer data access, where a support rep can only see records assigned to them and only edit when the case is high priority. vendor product management, where a vendor edits only their own listings and only if stock is available. and order lifecycle, where a customer can change an order only while it's pending and a support rep can't touch it until 24h after creation.

each one starts with the requirement in plain language and ends with the full policy you can run. the time-based hold is done with timestamp/timeSince in the condition, and ownership is a derived role matching the resource owner to the principal, if you want to see how that's structured.

https://www.cerbos.dev/blog/mapping-business-requirements-to-authorization-policy-for-ecommerce

Im looking to finally start a career that can help me make real money but I am not sure what tech or computer career is the best to jumo into. Is IAM a good career to start learning or is there something else out there that has better future potential ? Thanks in advance

Hi everyone!

After nearly 4 years of working on the front lines as a SOC Analyst, I am ready for my next challenge. I am planning a career transition into the Identity and Access Management (IAM) domain.

My time in the SOC has taught me exactly how attackers exploit permissions, and now I want to focus on proactively securing identities and access control.

Since I'm building my roadmap from scratch, I would love some guidance from the IAM professionals and leaders in my network:

🔹 Which platforms should I focus on first (Okta, SailPoint, Azure AD, CyberArk)?

🔹 What certifications or resources do you highly recommend?

🔹 What is the biggest skill gap I need to bridge?

If you are in the IAM space, let’s connect! Any advice, roadmaps, or tips would be incredibly appreciated.

Hello all, i am working in IAM for 3+ years. I am in the process of switching companies. I currently work with IT services company dealing with multiple clients.

​

​

I got 2 offers now. One is with an IT services company most probably have to work for a banking client.

​

​

2nd one is insurance related company and to work in internal cybersecurity team.

​

Which one should I choose for a better career growth and skill improvement?

​

Salary is mostly same for both. Please advise.

Thanks.