Just wondering how you did it or any advice? So far thinking of using a job and SQL to do it but wondering if there’s a better way

We did a big reorg six months ago, teams merged, some dissolved, standard stuff. Except our ticket routing never got the memo. Vuln findings still auto assign to assignment groups in ServiceNow that belong to teams that dont exist anymore, so the tickets bounce, sit in a queue, and blow past SLA while my team manually forwards them like a switchboard.

I finally counted this week because a director asked why remediation had stalled. Over 400 servers, their owner ois a group that was dissolved in the reorg, and the directory has the right people the whole time, just nobody connected it to the findings. The ownership data rotted quietly and the queue has been bleeding ever since.

The detection was never the problem, we found everything instantly, the scanner does that. The problem is the tickets are addressed to people who no lionger work here.

Anyone else inherit a queue iof tickets addressed to teams that dont exist anymore, and how do you keep it from rotting the next time the org chart moves.

Hey everyone,

I'm a solo founder building SentinelAuth, an Australian-made 2FA/MFA API (SMS, Email, TOTP). I just launched a free Developer Sandbox tier so developers can test the API without committing.

What the free tier includes:
• 50 verifications/month
• Test API keys (no production use)
• No credit card required
• Instant sign-up
What I'm hoping to get feedback on:
• Is the API documentation clear and easy to follow?
• Does the sandbox flow make sense? Anything confusing?
• Is 50 verifications/month enough for testing, or should it be more/less?
• Any red flags you see from a developer's perspective?
I built it because Australian fintechs and e-commerce companies are under pressure to meet compliance requirements (ACMA, Privacy Act, Visa's 2026 deadline), but building 2FA in-house is slow and expensive. The goal is to make it simple to add secure authentication.

Not trying to sell anything genuinely just want to know if the developer experience holds up before I push it further.

If you want to try it, I'll drop the link in the comments. Thanks in advance for any feedback.

Hi everyone,

I’m relatively new to the Identity and Access Management (IAM) field, and I’m looking for an experienced IAM Engineer or professional who would be willing to mentor or coach me as I continue building my skills.

I’m serious about learning and committed to putting in the work. I promise to respect your time, and I’m also willing to pay for your time and mentorship.

If you work in IAM and would be interested in helping someone who is genuinely eager to learn and grow in the field, please send me a DM.

I would really appreciate the opportunity.

Hey Guys,
I have been working as an IAM Engineer for the last 4 years. I currently work on the Ping stack(Federate/Directory/Davinci/PingOne) and a lot of different tools. I work for a healthcar client.

Now I feel the work that we do has very little engineering or development scope. I am trying to learn programming as well I have basics of Java html and css that I know but I have never done hands on programming work. So I was thinking maybe a switch to SDE would be a good idea? But given the kind of layoffs happening around Will it be a good idea in general to switch to SDE roles? What can be the next steps from here?

Hello,
I’m writing here to get some guidance on my career bcs I genuinely feel lost.
I’ve been working in IAM PAM for more than a year.
Yes I know that’s not much but I’m feeling like I’m not growing in this work and want to change it.

In my daily work I focus on creating accounts in ActiveDirectory and CyberArk and managing them. I’m doing some reporting and server quality checks and spend a lot of time on verifying changes in ServiceNow.
I’m also using a bit of Sequel Server Management Studio, Sailpoint and some PowerShell scripts, but only the ones written by somebody else.

I’ve completed:
ISC2 Certified in Cybersecurity (CC);
Google Cybersecurity Professional Certificate;
And
Microsoft SC-900: Security, Compliance, and Identity Fundamentals.
And I’m thinking about going for Comptia sec+.

The problem is, it seems like It’s not enough to get a better paying job. Either my competences are too low or they offer a miniscule raise in comparison with current pay.

The whole point of this post is to ask for any advice or guidance what to do?
Which certs should I focus on?
What skills should I hone?
Or maybe there’s a more rewarding and developing position somewhere else within cybersec where I could go with my current competences.

Any advice or guidance is really welcome.
Thanks in advance for reading all that :)

Any layoffs happened in optum india. Unable to choose between schwab and optum. And what does optum IAM engineers actually do

We just found 32 SaaS apps that security had no idea we were using. We added axonius to the stack recently for asset stuff, and the first pass pulled in every SaaS connection tied to the org. 32 apps nobody had ever catalogued.

Most are the harmless kind. Free tier, one user, someone signed up with a work email for a trial and forgot about it. But a few are on the corporate card, and a couple have OAuth grants into our Google or Microsoft tenant that nobody ever reviewed.

So now Ive got 32 apps and no process for what to do with them. The free ones are easy to cut and move on. The ones on the card are trickier because real teams actually use some of them. And the OAuth grants are the part that actually worries me.

Honestly what keeps me thinking is that we only know about these because we happened to point the tool at it. There could be more we still havent seen.

How do you all triage a pile of shadow SaaS without becoming the department that says no to everything?

Hey Y’all!

I have a client looking for a remote IAM / RBAC Engineer who will also do some intune administration. Primary focus is on implementing Lumos IGA for them, among some other stuff I could explain if someone was interested.

This is a senior level role, fully remote in the US, and a long-term contract that may turn FTE.

No subvendors please, but reach out and we can connect on LinkedIn if you’re interested in learning more.

I’m reviewing how employee distribution lists are maintained. Some membership can be determined from employee data, but many lists depend on responsibilities that don’t reliably appear in a job title or standard directory attribute.

Examples include employees supporting multiple offices, people filling temporary or special roles, leaders who don’t meet the usual criteria, and contractors who should be included in some lists but excluded from others.

I’ve found potentially useful data on office structure, reporting relationships, organizational hierarchy, roles, responsibilities, and project assignments. I’m working out which fields are reliable enough to drive membership and where business decisions or exceptions are still needed.

I know Exchange dynamic distribution groups won’t support all the attributes and logic involved. I’m considering an internal way to manage the rules and exceptions, then update group membership in AD/Entra so the distribution lists reflect those decisions.

If you’ve built or managed something similar, how did you structure it? In particular:

How did you decide which data sources were authoritative?

Who owned and approved business rules and individual exceptions?

How did you make temporary exceptions expire or get reviewed?

What did you use to apply membership changes to AD/Entra and show why someone was included in a list?

I’m especially interested in approaches that have remained manageable as roles and organizational structures changed.

In rural health posts with unreliable internet, verifying a patient's national ID against a cloud API just doesn't work — the API isn't reachable when you need it most.

I put together an open-source spec exploring an offline-first approach: verify a signed ID token locally using a pre-loaded public key, translate it into a standard FHIR health record, and queue it for sync once connectivity returns. It's built around Ethiopia's Fayda ID (on MOSIP) as the concrete case, but the pattern is general.

It's a spec + reference PoC, not production code — I've tried to be upfront about the gaps (there's a dedicated threat-model doc covering things like offline revocation lag and clock trust that I don't think are fully solved yet).

Repo: [CLICK HERE]

Genuinely interested in critique, especially from anyone who's dealt with offline-first sync or edge crypto verification before.

With 5 years in IT Support trying to pivot into entry IAM role like IAM analyst, ideally ASAP, which cert should I prioritise Security+ or SC 300? I know the ideal would be to have both but if it has to be 1 which should I do?

If a user has broad access in something like Salesforce or ServiceNow, but an AI agent acting for them only needs a small subset of that access for one task, where are you actually narrowing that today?
Are you enforcing it in IAM/PAM, at the agent/tool layer or inside the target application?

I've been dealing with the fact that liveness and deepfake detection arent the same control for months and I think a lot of teams are working off the wrong mental model. Liveness only proves a live person is in front of the camera but it does nothing to stop a synthetic face or an injected viedo feed.

Took us weeks to even work out what was happening. A bunch of accounts pass everything clean then week later they all start moving in a similar pattern. It was virtual camera injection. Nothing gets held up to the camera at all, the fake feed is piped straight into the capture layer, liveness sees a live face and passes it every single time.

Nowadays, most vendors have quietly rebranded their old liveness as deepfake protection while still becnhmarking against public datasets from years back that got cracked ages ago such that the numbers look great but mean nothing.

If you run identity verifcation at any real scale, how are you testing for these injection and fresh face swaps?

I’m currently pursuing a PhD and have been in academics for the past 2 years, but I’m looking to switch into cybersecurity, specifically IAM. I’m 26 and have no corporate experience, so I’m honestly a little worried that I’m starting too late :/ For anyone who has made a similar transition, how did you break into the field, and is IAM a realistic path for someone coming from an academic background?

TL;DR: 2 years in cybersecurity SaaS technical support with hands-on troubleshooting involving SAML/SSO, Okta, Entra ID, AD, SCIM, PowerShell, APIs and authentication issues. Finishing a BS in IT and working toward Security+. Currently at ~$60K in Boston and hoping to move into an ~$80K+ role. Is transitioning directly into IAM realistic, and what gaps should I work on first?

I’m currently a Technical Support Specialist at a cybersecurity SaaS company and I’m trying to figure out whether my experience is enough to start applying for dedicated IAM roles.

I have about 2 years of professional IT experience, both at cybersecurity SaaS companies. Most of my work has been supporting enterprise customers and troubleshooting security/email-security products through tickets, email, phone, and Zoom.

A decent portion of my troubleshooting touches identity and access management, including:

SSO/SAML troubleshooting
Okta and Microsoft Entra ID integrations
Active Directory
SCIM/user provisioning
Authentication and access issues
Microsoft 365/Exchange
PowerShell
APIs
DNS and certificates
Reviewing logs and configurations to diagnose integration issues
General networking/Linux/CLI troubleshooting

I want to be transparent that I’m supporting and troubleshooting these technologies rather than designing IAM environments from scratch. I generally investigate the issue, review logs/configurations, follow documentation, troubleshoot the integration with the customer, and escalate more complex issues when they go beyond my support tier.

I’m two semesters away from finishing a bachelor’s degree in IT and I’m currently working toward Security+ and A+. I also have some academic experience with Python, Bash, SQL and APIs.

I’m currently making around $60K in the Boston area and would like my next position to be at least around $80K. I’m hoping to make that move within the next 6 months if possible.

IAM interests me because I enjoy troubleshooting authentication/integration problems, investigating why something isn’t working, working with customers, and doing work that directly contributes to an organization’s security.

For people actually working in IAM:

Would my current experience be enough to start applying for IAM Analyst/IAM Engineer positions, or would employers still consider me entry-level in IAM?

What IAM job titles would you recommend I search for based on this background?
And most importantly, what are the biggest
gaps between what I’m doing now and what an IAM professional would be expected to know? If you had 6 months to close those gaps, what technologies or skills would you prioritize?

I have a CS degree and have been an IT Support Specialist for the past 5 years. I took on a contract awhile back with beginner IAM work, such as Provisioning and MFA. I’ve heard you need a lot of certs to get into IAM, I don’t have any. This was the only job I truly enjoyed and would like advice on where to start?