u/flywhee007

Putting together a video covering the most common interview questions in IAM, aiming for a mix that's useful whether you're a junior engineer prepping for your first IAM role or a senior consultant on the other side of the table.

If you've interviewed for an IAM role recently, what actually got asked? And if you've been on the interviewer side, what do you ask candidates that actually separates people who understand the concepts from people who've just memorized documentation?

Junior and senior perspectives both genuinely useful here, they tend to reveal very different things.

UPDATE: Video is made and posted in yt channel (link in my profile)

Question that comes up constantly: what order do you learn IAM, and how do you actually get from concepts to something you can show to pivot into IAM.

Concepts -> lab -> product -> cert. In that order.

Concepts first because they transfer. Joiner-mover-leaver, RBAC, authentication vs authorisation, IGA vs ciam. None of it is vendor specific and all of it survives the tool changing when you switch IAM jobs.

Lab next, because reading about a provisioning pipeline and actually building one are not the same skill. Open source is fine. HR record in, account gets provisioned, status flips to terminated, account gets disabled. Break it a few times and the concepts stop being abstract. or CIAM use cases based on standards like oidc, saml, t&c, consent mangement etc.

Product is where most people start, and that's why they get stuck. Once you know what a joiner process is, Okta or Entra is just learning where the buttons are. Free tenants are enough.

Cert last, and only the one showing up most in job ads in your area. Gets you past ATS filters. Does not teach you how to implement anything.

Curious what order others took, and if anyone went product first and it worked out.

Following on from the IAM Q&A session last Saturday, a few people asked about actually getting the lab running rather than just understanding what it does.

So this Saturday I am doing a live session where I set up the full IAM lab from scratch. You watch, follow along on your own machine if you want, and ask questions as we go.

What we will cover:

• We spin up IGA, an HR source system, and target system (ldap) all connected and talking to each other.
• Then we see how to connect an IAM concept to hands-on use case, with an example joiner process, so you can see an employee created in HR and automatically provisioned in the directory. It can then be applied to all other IAM concepts.
• We will also cover OIDC or SAML quick setup
• an open floor for questions

Open source tools only. No vendor bias. no vendor product pitches.

The lab is free for anyone wants to try hands-on in IAM.

Session link in comments, it will be on Saturday June 13th.

Update: the recording is available in yt channel (link in my profile)

This subreddit has been genuinely useful to me, both for staying current on IAM topics over years…

I am running a Q&A next Saturday (session link is in the comments below).

Open to anyone related to IAM.. If you are already working in IAM and want to share your experience or perspective during the session, you are welcome to join too.

It will be about an hour, we roughly cover:

How IAM is structured across IGA, Access Management, PAM and CIAM and where each fits in a real organisation.

What the actual career paths look like and what realistic salary ranges looks like in US and Europe.

The knowledge gaps most IT professionals have regarding IAM and how abouts on vendor certifications.

Bring your specific background. Open Q&A the whole way through. Honest answers, no pitch, no vendor bias.

Here is my honest take on certifications in this field. Others, feel free to jump in.

Vendor-neutral certifications like CISSP and CISM signal breadth and experience (i have both these & they helped me in career progression to be honest than product certs once I got some IAM experience, they didn't matter at the start). They carry weight at the senior and architect level. But they require 5 years of experience minimum to certify - they are not a starting point.

Vendor-specific certifications like SC-300, SailPoint, Okta, and Ping Identity signal product knowledge. They help you get past filters e.g. ATS while job hunting in IAM space.

General order of priority for someone breaking into IAM imo:

1. Core concepts first in IAM, you could ask any AI to know those.
2. atleast some hands-on of those concepts using lab e.g. IGA or CIAM lab with free trials of products, that are most mentioned in job profiles you are targeting, mostly in your location.
3. And then also One vendor cert that matches the job descriptions you are seeing in your area
4. CISSP when you have the experience to qualify or if you are already in IAM.

What certifications have you found actually moved the needle in your job search, whether when you are new to IAM or with experience when trying to move further in IAM career?

Hey all
Attending soon Okta’s conference as a partner.

Theme as shared by them: AI agents as first-class identities, governing and securing them the same way you would a human workforce identity or existing service/technical accounts.

A few Qs I have in mind:
Handling lifecycle for AI agents today or is it still ad hoc like robotic accounts we are seeing in some implementations?

Where does the IGA layer fit when the identity has no HR record?

What are implementing consultants here seeing that existing IAM vendors are not talking about yet?

Curious to hear what others are seeing in their IAMs already.

I have been on both sides of IAM interviews as a candidate early in my career and as the person asking the questions for the last 15+ years. I am curious what others with similar experiences can add.

Most guys show up with a list of products they have used at work and a certification or two. however, for me, a resume with github link would help.

Not polished code. Not a perfect lab. Evidence of implementation thinking.

• Screenshots of a working Joiner workflow with a README explaining what each component does and why
• A decoded JWT with annotations on what each claim means or a SAML assertion captured in SAML-tracer with notes on what the IdP is doing
• Errors faced while configuring JML or access certification processes in your IGA lab
• A short write-up of what broke during a lab and how you fixed it

The troubleshooting notes are often more impressive than the working screenshots. They show you understand what is happening under the hood.

See comment below for free IAM labs you can use to build this out if you are starting from scratch.

I have been reading this subreddit for months. The same problem comes up constantly - people who understand IAM conceptually but have never touched a real implementation. No lab, no demo, nothing to show in an interview.

I built two free lab environments to fix that in my free time. Posting here because this community is exactly who they are for. Tell me what breaks - I will fix it. [Link to labs in comments]

Lab 1 - IAM (IGA) with full working IAM with one target app and one HR app (OVA download)

A pre-configured VirtualBox VM with a full open-source IGA platform, LDAP as target system, and a simulated HR system already wired together. You import the OVA, start the VM, and you have a working Joiner and Leaver pipeline running on your laptop in under 20 minutes.

• Add an employee in the HR system
• Run reconciliation in IAM/IGA
• Watch the LDAP account appear automatically in ou=people
• Terminate the employee
• Watch the account move to ou=inactive

This is the JML lifecycle that every IGA implementation is built around. You build it yourself, you own it, you can enhance it further to demo it in interviews based on job profile.

Lab 2 - Access Management (CIAM) with Auth0

A separate hands-on classroom covering OIDC, SAML federation, and B2C identity flows using Auth0 (from okta). Built for people who want to understand the access management side and CIAM - SSO, token inspection, real protocol flows, which compliments learnings of Enterprise IAM from Lab 1.

Both classrooms are free inside the SimplifyIAM community on Skool.

Not a course, but a lab you build, together with IAM community.

Note: Not affliated to any of the tools mentioned. All of them are free to use or open-source.

I have been in the IAM space for about 18 years in various roles. I am part of technical interviews for junior to mid experience roles, and the landscape seems completely different now. When I talk to guys trying to transition to IAM, I see a massive divide. Some are learning Microsoft SC-300 or Okta or open source IAM home labs.

For those of you trying to get your first IAM role right now, what is your actual path? Curious what the learning curve looks like for you today.

Also curious to hear from what other veterans in the space are seeing in the interviews.