How to get an
IAM job in cybersecurity

Identity and access management decides who — people, services and devices — can access what, and proves they are who they claim to be. The core areas are authentication (passwords, MFA, passkeys, certificates), single sign-on and federation (SAML, OpenID Connect), authorisation models (role-based and attribute-based access, least privilege), the identity lifecycle (joiner–mover–leaver), access reviews and certification, privileged access management, service accounts and machine identities, and identity governance and auditing.

Identity has become central to security. NIST SP 800-207 describes zero trust as making access decisions based on identity and context rather than network location,¹ and NIST's SP 800-63 Revision 4, finalised in July 2025, updates guidance on identity proofing, authentication and federation.² CISA urges organisations and individuals to turn on MFA everywhere.³ In India, AmbitionBox lists IAM analysts at a typical ₹6.3–6.9 lakh,⁴ with security architects — who often design identity strategy — at ₹28.4–31.4 lakh.⁵

NIST SP 800-63 Rev. 4 finalised

2025

Typical IAM analyst pay in India (AmbitionBox)

₹6.3–6.9 lakh

Typical security architect pay in India (AmbitionBox)

₹28.4–31.4 lakh

Lifecycle stages: joiner, mover, leaver

3

Table: How IAM candidates are assessed (editorial summary)

Table: A role-based access model (illustrative)

Table: How identity and access management developed (editorial summary)

• SSO configured for a test app
• MFA and passkeys in a lab
• A role-based access model
• An automated leaver process design
• A privileged access plan
• A verified IAM certificate

Show risk reduction: "Automated leaver deprovisioning from HR; removed 140 orphaned accounts; moved cloud admin to just-in-time access; rolled out SSO with phishing-resistant MFA."

"Authentication vs authorisation?"

Who you are versus what you can do.

"How do you implement least privilege?"

Role-based access with minimal defaults, just-in-time elevation and regular reviews.

"Why are SMS codes weaker than passkeys?"

SMS can be phished or intercepted; passkeys are bound to the genuine site and device.

"How do you handle service accounts?"

Inventory them, scope permissions, rotate secrets, use managed identities and monitor usage.

"What's an access review?"

Managers or owners confirming each person still needs their access, with removals tracked.

• "Which identity provider is used?" — tooling.
• "Is joiner–mover–leaver automated?" — maturity.
• "How are admin accounts protected?" — risk.
• "Are passkeys on the roadmap?" — direction.

Table: Identity roles and typical pay in India (AmbitionBox, October 2026; indicative)

Table: Common IAM tools (editorial guidance)

• IT / service desk — account administration.
• IAM analyst — provisioning and reviews.
• IAM engineer — integrations and automation.
• IAM architect — identity strategy.
• Head of identity / security architect — enterprise identity.

1. Week 1: Concepts — AuthN, AuthZ, SSO, MFA and passkeys.
2. Week 2: Lab — Set up SSO and MFA with a free identity provider tier.
3. Week 3: Model — Design roles and a leaver process.
4. Week 4: Prove it — Plan privileged access; take the IAM Certification.

Related: Cloud Security, Cybersecurity Fundamentals and Privacy and Data Protection. Guides: cloud security, cybersecurity fundamentals and data protection.

• Access requests — approving and provisioning.
• Integrations — SSO for new apps.
• Reviews — quarterly certifications.
• Investigations — suspicious sign-ins.
• Automation — lifecycle workflows.
• Policy — conditional access rules.

"What's conditional access?"

Policies that grant or block access based on user, device, location and risk.

"What is a break-glass account?"

An emergency admin account, tightly controlled and monitored, for when normal access fails.

Table: A first-90-days plan (editorial guidance)

Start with an inventory of identity sources, admin accounts and MFA coverage. Fix the biggest gaps first — usually leavers and admin rights. Then establish regular access reviews and just-in-time privileged access.

AI deepfakes now target identity processes — help desks resetting passwords for callers who sound like executives, and video verification spoofed by synthetic faces. Identity teams respond with phishing-resistant MFA, stricter reset procedures and liveness checks. AI also helps defenders by spotting anomalous sign-ins and suggesting access clean-ups based on actual usage.

AI agents add a new identity challenge: agents and automations need their own scoped, auditable identities and credentials. In interviews, show you understand how to give AI agents least-privilege access and how to protect identity processes from AI-powered social engineering.

Export each user's access by system and role. Send managers or system owners a clear list to confirm or remove, with a deadline. Highlight risky items — admin rights, dormant accounts, access unused for 90 days. Track completion and actually remove revoked access, then confirm removal. Report results to leadership. Reviews only work if removals happen; a signed-off spreadsheet with no changes is a warning sign.

"MFA solves everything." Weak MFA can be phished; reset processes and session theft are also risks.

"Admins need permanent access." Just-in-time access works for most tasks.

"IAM is just account creation." It's governance, risk and architecture too.

Start with the HR system as the source of truth for who works at the company, their role, manager and start or end date. Connect it to the identity provider so accounts are created automatically on a joiner's start date with a baseline set of access tied to their role. When someone moves teams, the change in HR should trigger removal of old role access and granting of new role access — not simply adding more. When someone leaves, accounts should be disabled on their last day, sessions revoked and tokens invalidated, with data ownership transferred to their manager.

Handle exceptions deliberately. Contractors need end dates by default. Emergency terminations need an immediate manual path that still updates the source system. Shared and service accounts need named owners so they aren't forgotten when people leave. Test the process regularly by sampling recent leavers and confirming their access was removed everywhere, including SaaS tools outside single sign-on. Most audit findings in identity come from gaps in this lifecycle, so a well-designed process is one of the most valuable things an IAM professional can deliver.

• Manual leaver processes.
• Permanent admin rights.
• SMS-only MFA for high-risk access.
• Ignoring service accounts.
• Access reviews without removals.

Identity guidance comes from NIST SP 800-63 Revision 4 and SP 800-207; MFA guidance from CISA; and India pay from AmbitionBox (read October 2026). The access model, review guidance and history are editorial. Science of Apps publishes the free test linked here. Last reviewed October 2026.

• Authentication — proving identity.
• Authorisation — granting permissions.
• SSO — single sign-on.
• PAM — privileged access management.
• Passkey — phishing-resistant passwordless credential.