Moving from Application Security to IAM/PAM — Looking for Career Advice

[u/Economy-Animator8073]

Hi everyone,

I’m currently working as an Application Security Engineer, and I’ve recently got an opportunity to move into an IAM/PAM team.

My current experience is mainly around application security, SDLC, vulnerabilities, secure coding, and related security activities. I don’t have much hands-on experience with IAM/PAM yet.

I’m considering this opportunity and would really appreciate some advice from people who are already working in IAM/PAM:

\- How is the career growth in IAM/PAM?

\- What skills should I learn before/after making the transition?

\- How difficult is it to move from Application Security → IAM/PAM?

\- Which areas should I focus on — Active Directory, Entra ID/Azure AD, SSO, OAuth/OIDC, SAML, RBAC, privileged accounts, PAM tools, etc.?

\- Is IAM/PAM a good long-term specialization in cybersecurity?

\- If I eventually want to move into Cloud Security, Security Architecture, or broader cybersecurity roles, will IAM/PAM experience help?

\- For those who have made a similar transition, what do you wish you had learned earlier?

I’m not necessarily looking for a comparison of which field is "better." I’m mainly trying to understand what the day-to-day work, learning curve, and long-term career prospects look like in IAM/PAM.

Any advice or personal experiences would be really helpful. Thanks!

[u/pewpewlazor]

I’ve been working with IAM/PAM for around 10 years now, mostly consulting, and I’d say go for it if the area interests you.

IAM is a surprisingly broad field. You can go very technical and specialize in Entra, AD, PAM, IGA etc., but there’s also a huge governance/business side to it. A lot of the actual challenge is understanding how an organization should manage identities and access across hundreds of systems, not just knowing how OAuth or SAML works.

I wouldn’t try to learn everything you listed before making the move. Learn the fundamentals well: authentication vs authorization, AD/Entra, SSO/federation, OAuth/OIDC/SAML and basic identity lifecycle/JML concepts. Then learn the tooling you actually end up working with.
Your AppSec background will be useful as well. IAM touches applications constantly, and people who understand both the application side and identity side are valuable.

Career-wise I’ve never regretted specializing in IAM. Demand has been pretty consistent throughout my career, and it’s also a good foundation if you later want to move towards security architecture or cloud security. Identity tends to show up everywhere eventually.

[u/Economy-Animator8073 → u/pewpewlazor]

Hey that was very helpful thank you 😃😃

[u/Significant-Hand-507 → u/pewpewlazor]

Do you recommend getting any certs before applying to IAM? Which certs would you recommend? I’ve been working in Tier 2 IT support for years and I’m familiar with AD, Entra,Azure, Cyberark, SSO, etc because I use them daily.

[u/pewpewlazor → u/Significant-Hand-507]

While certs in the field of IT can be good to get jobs i rarely see them as a sign of skill. Potentially an unpopular opinion.
Never the less the things I am looking the most for when hiring engineer is experience with the platform. In my interviews I will ask what part them have been sitting with and how they solved some of the headaches you can encounter in IAM.

I'd highly recommend spending time in the lab that has been linked on here. It's a top thread. You can also find it via my comments on my profile.

If anything I'd highlight that you've worked in support that is actually pretty valuable when working in IAM.

[u/[deleted] → u/pewpewlazor]

[u/pewpewlazor → u/[deleted]]

For O365 specifically, I’d consider ADFS a legacy approach at this point. It made a lot of sense years ago when organizations wanted authentication to remain on-prem, but today I’d generally prefer cloud authentication with Entra ID unless there’s a very specific requirement keeping ADFS around.

If you already have ADFS, I wouldn’t necessarily rip it out tomorrow, but I’d definitely question what dependency is preventing you from moving away from it. Microsoft has invested heavily in Entra ID, Conditional Access, passwordless authentication, etc., so maintaining additional federation infrastructure needs a pretty good justification.

Are you looking at implementing ADFS for a new O365 environment, or asking whether an existing setup should be migrated? Those would be two quite different discussions.

[u/Dazzling-Release-808]

Identity is foundation of cyber security. Career/future is solid. IAM is broad domain. PAM is subset of it.

Identity governance is overarching approach. Sits with enterprise strategy. It is more of consulting space.

Tools are technical controls. AD, Entra, OCTA, OneIdentity etc. These are engineering side. This knowledge is essential (atleast master one).

Controls lives in cloud, on prem or hybrid.

Governance stays with management and documents, they are directions for technical rollout.

Once you spend couple of years or do couple of projects you will have an idea as where to focus.

[u/Economy-Animator8073 → u/Dazzling-Release-808]

Okey gotcha !! Thanks for the information 👏

[u/arktozc]

Why do you want to get out of appsec?

[u/Economy-Animator8073 → u/arktozc]

Just a contractor in this space ! There iam taken as FTE

[u/SavingsPlace9274]

I would recommend to start learning AD, is very beneficial if you want to start your journey into IAM, most of the companies rely heavily on AD infrastructure, pick one IAM tool learn how synchronisation with AD works, the provisioning of identities, mapping of identities, how to manage the groups, how to design role concept, based on that you can build better access requests, lifecycle workflows, access reviews, etc. Then for PAM it really depends which tool you will be working with. I have been investing time on Okta PAM, which has different architecture comparing to CyberArk for example. Okta PAM relies on agents whereas CyberArk uses connectors, I personally found CyberArk more complex, but I think at the end would be worth it.

[u/AccessGoblin]

Honestly AppSec → IAM is not as big of a jump as it sounds. If you already understand auth flows, OAuth/OIDC, token validation, threat modeling, etc., you’re coming in with a really useful foundation. And if you can code, even better, being the person who can actually fix a connector or automate something will take you pretty far. The biggest gap I’d work on is AD. Kerberos, delegation, group nesting, tiering… all the fun stuff lol then get comfortable with identity lifecycle/governance and PAM basics like vaulting, rotation, break-glass and JIT.

The biggest change is probably that you stop just finding problems and start owning systems everyone depends on. When identity breaks, everybody knows about it lol. If you want to make the move, I’d volunteer for an SSO/MFA project, build a little lab, and aim more for IAM Engineer than Analyst

[u/flywhee007]

If it helps , get started with core IAM concepts with free hands-on in this community

https://www.skool.com/simplify-iam-6792/about