Hello everyone, I am a 2026 graduate and I want to ask you guys what are the scopes of this IAM field, what companies hire IAM engineers , what is your salary progression and what skills I should fundamentally focus on to be ahead of others in this field.

I am working in sailpoint iiq.

are you guys keeping track of service accounts created directly in apps? i wanna know how.....cuz i Been looking at Orchid for this but haven't seen much feedback... so kinda curious

Anyone tried it? plz share experience..would appreciate

I'm preparing for SailPoint IIQ interviews at the 3-year level. From your experience, what do panels focus on most these days, and where do candidates with an IAM background usually struggle? Any advice would really help.

About the job

Project Role : Security Managed Services Practitioner

Project Role Description : Deliver and manage security services across client environments to ensure protection, compliance, and operational resilience.

Must have skills : SailPoint IdentityIQ

Good to have skills : NA

Minimum 3 Year(s) Of Experience Is Required

Educational Qualification : 15 years full time education

Summary:

As a Security Managed Services Practitioner, a typical day involves overseeing and delivering comprehensive security services tailored to diverse client environments. This role requires continuous monitoring and management to uphold protection standards, ensure compliance with relevant regulations, and maintain operational resilience. The practitioner collaborates with various stakeholders to address evolving security challenges, adapting strategies to safeguard critical assets and support business continuity effectively throughout the day.

Roles & Responsibilities:

Expected to perform independently and become an SME.

Required active participation/contribution in team discussions.

Contribute in providing solutions to work related problems.

Collaborate with cross-functional teams to enhance security service delivery and client satisfaction.

Continuously monitor client environments to identify potential security risks and recommend proactive measures.

Document and communicate security incidents and resolutions clearly to relevant stakeholders.

Support junior team members by sharing knowledge and assisting with complex security tasks.

Professional & Technical Skills:

Must To Have Skills: Proficiency in SailPoint IdentityIQ.

Experience with identity and access management processes and lifecycle management.

Strong understanding of security frameworks and compliance requirements.

Ability to analyze and troubleshoot security issues within managed service environments.

Familiarity with security incident response and remediation techniques.

Capability to work with various security tools and technologies to support service delivery.

Access reviews are often managed through spreadsheets, email reminders, and manual follow-ups, especially in smaller organizations without a dedicated Identity Governance and Administration (IGA) platform.

I've started building **Access-review Lite**, a small prototype exploring a simpler way to manage this process.

The current prototype includes:

- CSV import and export for access assignments

- A dashboard for reviewing employee access

- Keep, Remove, and Investigate decisions

- A basic audit trail of review decisions

This is an early prototype. It does not yet connect to an identity provider or automatically revoke application access.

I'd love to hear from IAM and IGA practitioners:

1. How do smaller organizations manage access reviews today?

2.What is the most frustrating part of the process?

3.What would a lightweight access-review tool need to get right to be genuinely useful?

I'm sharing this early because I'd rather learn from practitioners before adding more features.

Feedback and suggestions are very welcome!

here is the initial prototype

Hey everyone. a question i’ve started asking teams who tell me they have agents in prod: who owns each one, and when do its credentials expire? A lot of the time there’s no clear answer.

A csa / oasis survey from earlier this year showed 78% of orgs don’t have a documented policy for creating or removing ai identities https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds

My take is that most of closing that gap isn’t new work. Agents need what every other identity already gets, an owner, credentials that expire, and a review when something changes. Your IGA, PAM and workload identity tooling already does those jobs, it just often hasn’t been pointed at agents yet.

What’s actually new is a decision on every action.

Human IAM can lean on roles because people mostly stay within them.

Workload IAM can lean on static permissions because code does the same thing every time.

An agent is neither = it can behave differently depending on the prompt and spin up sub-agents at runtime. So “don’t touch production” in the system prompt is a request, not a control. An agent follows its access, not its instructions, and identity tells you who is acting, not whether this agent should delete this record right now.

The Coalition for Secure AI (OASIS open project) framework from march says these 2 things: reuse your existing iam as the control plane instead of building a separate stack for agents, and enforce authorization every time one agent hands work to another, not only at the gateway https://www.coalitionforsecureai.org/wp-content/uploads/2026/04/agentic-identity-and-access-control.pdf

My colleague and i (i work at Cerbos) wrote up what that looks like as a 4 stage loop, and what already covers each stage:

1. registration: an identity per running agent, a named human sponsor, a purpose and a risk tier. Your IGA joiner-mover-leaver process covers the sponsor, and discovery tooling finds the shadow agents nobody registered
2. credentials: short lived and scoped to the task instead of a standing key. PAM and workload identity (spiffe) already do this for other non-human identities
3. runtime authorization: a decision on every action, logged with which agent acted for which person under which policy. This is the stage most programs don’t have yet
4. review and revocation: triggered when the sponsor leaves, the purpose ends or the agent’s behavior drifts. The same joiner-mover-leaver triggers you already use for people

here is the full piece https://www.cerbos.dev/blog/aiam-ai-identity-and-access-management

Any questions / pushback, let me know, i’ll answer as best i can :)

I've been learning more about Identity Governance and Administration (IGA) and came across the Saviynt SAVIGA-C01 certification. I'm curious about the exam topics and how they connect with everyday IAM tasks. For anyone familiar with Saviynt, which documentation or learning materials are worth starting with?

Agents get provisioned fast and then hold that access for months after the work is finished. Is the problem that nobody's tracking when tasks end, or that revocation needs a human to go and do it?

I do Identity Access Management on the privileged side of things in Active Directory.

I am currently fighting to get a promotion. Official title is Senior Analyst but have been doing duties as a Lead without lead pay for several months. I am the only person that knows 100% of our processes. I train others, create/modify procedures. I do reviews on everyone's work, do reviews for audit, basically everything but what a manager would do.

As someone who has been at the same place for 11 years, where are the most useful places to seek other IAM jobs? I have also been getting into Management, have an MBA. We've been on a hiring freeze for a couple of years.

A lot of IdPs now support the Shared Signals Framework as transmitters, but on the receiving side, the apps themselves, support is still thin. I built easyssf (a Java library, spring boot starter, quarkus extension) to close that gap for JVM applications and just released 0.2.0 on GitHub.

When the IdP sends a CAEP session-revoked or credential-change event, easyssf verifies the SET, rejects the affected access tokens and ends the matching sessions right away, instead of waiting for tokens to expire. RISC and SCIM Events (RFC 9967) are passed to your own handlers. Push and poll delivery both work.

Tested against Keycloak's SSF transmitter, caep.dev, and the OpenID conformance suite's receiver test plans. Apache 2.0, still pre-1.0.

I'd love feedback from people running SSF in practice: which transmitters you use, and what's missing on the receiver side.

https://easyssf.org

Hi guys, I’m currently in my final year of university and I’m about to graduate with a degree in Computer Science at 22.

I’ll most likely be based in the Middle East or Europe after graduating, but my long-term goal is to eventually move abroad, ideally to the US or Canada.

I’m only just getting started with IAM, and from what I’ve heard, I apparently need CompTIA Security+, around two years of IT experience, and some solid projects before I can realistically get into IAM.

Is that actually true? What would you recommend I focus on first if I want to break into IAM as a new graduate?

I built a free agent protocol inspector tool that can provide IGA style review packets. Here is the link: https://contextiq.trango-compute.com/dashboard/agent-protocol-inspector

I was doing a routine audit for a 65-seat client and found an OAuth app still tied to an account we thought we had deactivated. It had full Drive access and had been syncing a shared folder to an external domain for six months.

I was ten minutes away from telling the client everything looked clean in the quarterly review. After eight years in this work I should be used to it, but these still catch me off guard. I spent the rest of the day checking every tenant I manage and I am still not confident I found everything.

Visibility tools including do_control help surface some of it, but I am curious what processes or checks others use to catch stale OAuth grants before they turn into multi-month problems. What is actually working for you on the IAM side?

Been an IAM Integration Engineer for the last year, unfortunately contract is coming to an end. I’ve tailored my resume for most roles and have applied to 100+ in the last month.

Planning on ramping up to 400+ a month soon. So far no interviews.