Heads up: These are my own views. I used Google Gemini Deep Research for the heavy lifting, but I promise a human reviewed every word.

Identity and Access Management (IAM) has decoupled from general IT administration. While the broader tech sector has stabilized with flat compensation, IAM has split into a high-value vertical driven by cybersecurity mandates and regulatory pressure.

The “IAM Administrator” role, historically defined by manual provisioning and GUI management, is dead. It has been replaced by the “IAM Engineer,” a role that demands security theory, software engineering principles, and automation.

At the entry level, the “IAM Analyst” title has bifurcated. One track handles support tickets; the other handles Governance, Risk, and Compliance (GRC). The money is in the latter.

The Market Reality

General tech salaries are projected to rise just 1.6% in 2026. Security roles are tracking at 4.0%. AI/ML leads the pack at 4.4%, but IAM rides alongside it because you can’t deploy AI without identity governance.

Here’s what matters: 52% of tech leaders say they’ll increase starting offers for candidates with security skills. That’s second only to AI/Data Science (59%). If you’re on the fence about pivoting into security, that number should settle it.

The market has tiered technology roles into “Commodity” and “Strategic” buckets. Roles susceptible to automation, such as entry-level help desk, basic coding, and manual administration, are seeing wage stagnation. Strategic roles that ensure business continuity and audit survival are seeing aggressive growth.

The AI Factor

Cliches about “AI taking jobs” are partially true here. The “Joiner-Mover-Leaver” (JML) process used to employ thousands of junior admins. That work is now automated by IGA platforms.

But AI has created a massive new headache: Non-Human Identities.

Bots, service principals, and AI agents now outnumber human employees by a factor of 10 to 45, depending on your architecture. They need accounts, permissions, and governance. A specialist who knows how to secure an AI agent using Workload Identity Federation writes their own ticket in this market.

The same goes for Secrets Management. If you can automate the rotation of API keys and certificates, you’re solving a problem that keeps CISOs up at night.

Title Changes

The Death of the “System Admin”

For twenty years, “System Administrator” was a solid career. In IAM, that title now signals “legacy.”

Recruiters and hiring managers associate “Administrator” with:

• Manual clicking in Active Directory
• Resetting passwords
• “Keeping the lights on”

They associate “Engineer” with:

• Writing Python or PowerShell to hit APIs
• Integrating SaaS apps via OIDC
• Managing configuration via Git (Infrastructure-as-Code)

If your resume says “Administrator” but you do engineering work, change it. A Reddit thread from last year put it bluntly: “Unless your end game is to be an IT Manager… pivot now.”

The Analyst Split

If you are applying for an “IAM Analyst” role, check the job description. The title is used for two completely different jobs.

Job A: The Ticket Queue (Operations) You will unlock accounts and troubleshoot MFA failures. It pays $55k - $75k. It is effectively specialized Help Desk. Metrics are driven by ticket closure rates and SLAs. It’s high-volume, reactive work.

Job B: The Auditor (Governance) You will run Access Certification campaigns, chase managers for approvals, and gather evidence for SOX/ISO audits. It pays $75k - $90k. The work is cyclical. It is brutal during audit season, but calmer otherwise. This path leads to IAM Manager, IT Risk Manager, or GRC Architect.

Overlooked angle: The Governance track is a back door into cybersecurity for people without a CS background. Candidates from business analysis, library science, or legal studies often outperform here because the job is about process, detail, and documentation, not tinkering with code.

CIAM vs. Workforce: Two Different Worlds

There’s a third split you should know about: who you’re managing identities for.

Workforce IAM: Your users are employees and contractors. Focus is on security, Zero Trust, and internal efficiency.

Customer IAM (CIAM): Your users are paying customers. This is treated less like IT Security and more like Product Engineering. You’re expected to know API security, UX design, and how the login flow affects conversion rates.

CIAM pays more. It’s also harder to get into because the interview process is more technical. If you have a software development background, CIAM is where you should aim.

Salary Data (US Market)

Geography Still Matters

Remote work has compressed the gap, but it hasn’t eliminated it.

Tier 1 (San Francisco, NYC, Seattle): Expect 20-30% above the median. An IAM Engineer in NYC starts around $130k, not $100k. You pay for it in rent.

Government Hubs (DC, Northern Virginia): A TS/SCI clearance is an automatic +$40k. An IAM Engineer with a clearance can hit $150k-$180k, which is more than their private sector peers in the same building. The catch: you’re usually onsite, and the clearance process takes a year.

Regional Hubs (Chicago, Austin, Atlanta): Salaries track close to the national median ($110k-$120k for Engineers), but cost of living is 30-40% lower than the coasts. Best “real” income.

Remote/National: The market has consolidated around Tier 2 salaries. You can live in a low-cost area and earn Austin money. The tradeoff is more competition for fewer fully-remote roles.

The Premium Kickers

• The Developer Premium: Engineers who write real code (not just copy-paste scripts) see a ~20-25% bump. ZipRecruiter lists “IAM Developer” roles with medians around $144k.
• The SailPoint Tax: If you can implement and maintain SailPoint IdentityIQ, you’re looking at $130k+ as a floor. The tool is complex enough that supply never meets demand.

The Technical Stack

You can no longer survive on “Active Directory Users and Computers.”

1. The Duopoly: You need to know Microsoft Entra ID (formerly Azure AD) or Okta. Ideally both. Microsoft owns the enterprise; Okta owns the startups and the CIAM market (via Auth0).
2. The Plumbing: Stop memorizing button clicks. Learn the protocols.
   • OIDC: For logging into apps. The modern standard for mobile and SPAs.
   • OAuth 2.0: For authorization, which defines what you can do once you’re logged in.
   • SAML 2.0: The legacy standard. Still everywhere in enterprise SaaS (Salesforce, Workday).
   • SCIM: The unsung hero. This is the API standard for automatic user provisioning. When HR creates an employee, SCIM creates their Slack account.
3. Governance (IGA): SailPoint remains the standard for big companies. It’s complex and demanding, and pays extremely well. Saviynt is the up-and-comer.
4. Secrets & PAM: CyberArk and HashiCorp Vault. This is where the machine identity work happens. If you understand secrets rotation, you’re ahead of most candidates.

Certification Strategy

Most certs are useless for getting hired. They’re checkboxes for HR, not proof of skill. That said, some checkboxes are mandatory.

Entry-Level (0-2 Years)

1. CompTIA Security+: The HR filter. You usually can’t get a government-adjacent job without it. DoD 8570 requires it.
2. Microsoft SC-900: The introduction. Low-barrier exam that gets you familiar with Entra, Purview, and Sentinel vocabulary. Good for resumes, not proof of skill.
3. Okta Certified Professional: Unlike multiple-choice exams, this one involves practical simulations. It proves you can actually navigate a console.

Practitioner (2-5 Years)

1. Microsoft SC-300: The “I know how to do the job” exam. It covers Conditional Access, Identity Protection, and Governance. This is the current gold standard for operational IAM roles.
2. CISSP: The management card. Get this if you want to be a lead or a manager. If you have under 5 years of experience, you get “Associate of ISC2” status, which still signals the management mindset.

The “Lab” Shortcut

If you have no experience, don’t just get a cert. Build a lab.

Get a free Microsoft 365 Developer tenant (it comes with Entra ID P2). Get a free Okta Developer account. Now:

1. Set up Okta as your IdP.
2. Federate it to Entra ID using OIDC or SAML.
3. Enable MFA on the Okta side.
4. Configure Conditional Access on the Entra side.
5. Document the whole thing: screenshots, config snippets, problems you hit.

Put it on GitHub or write a blog post. In an interview, “I built a federation between Okta and Entra ID last weekend and here’s what I learned” beats “I passed a multiple choice exam” every time.

What Interviewers Actually Ask

Interviews have moved away from trivia (“What port is LDAP?”) toward scenario-based questions. Be ready for:

For Analyst/Operations roles:

• “A user is locked out of their account at 2 AM and says they have a critical deadline. Walk me through your process.”
• “How do you explain MFA to an executive who thinks it’s too inconvenient?”

For Engineer roles:

• “Design an authentication flow for a mobile app. When would you use OIDC vs. SAML?”
• “We have 10,000 users who haven’t logged in for 90 days. How would you automate the cleanup?”
• “A service principal in Azure needs to write to a storage account. How do you secure it without a client secret?”

For Architect roles:

• “We’re migrating from on-prem Oracle Identity to cloud-based Okta. What’s your 12-month roadmap?”
• “How do you handle pushback from a VP who says your new policy is too restrictive?”

The Architect questions are partly technical, partly political. You’re being tested on whether you can advocate for security without torpedoing relationships.

Paths In

There are many paths into IAM; these are just examples. None of this is set in stone; the beauty of technology is that people break the mold all the time.

From Help Desk: Leverage your access. Ask the current IAM team if you can handle their ticket backlog. Use the Operations Analyst role as a stepping stone, but start learning Python or PowerShell and SC-300 material immediately to pivot into Engineering.

From a Non-Tech Background: Target the Governance Analyst track. Highlight attention to detail, process management, and writing ability. Learn the language of compliance (SOX, GDPR, HIPAA). You’ll become valuable to the CISO during audit season.

From CS/Development: Skip the Analyst tier entirely. Target “IAM Developer” or “Identity Engineer” roles. You already know how to code; now show that you understand identity as a concept, not just an API to call.

Data compiled from Robert Half 2026 Technology Salary Guide, Motion Recruitment, ZipRecruiter, Payscale, Salary.com, and Q4 2025 public job boards. Interview questions sourced from r/IdentityManagement and r/cybersecurity.

🎯 Goal: Deliver the simplest reliable plan that matches your priorities, with safety and privacy by default.

💡 Why I Built It

Jen Hamilton posted a great TikTok asking for the most life-changing home automations. One reply jumped out: “When the dishwasher finishes, my kids’ Wi-Fi pauses until they empty it.” Genius.

The comments told two stories: lots of creative ways to build it, and lots of people unsure where to start. There is no single answer that fits every home network, platform, and appliance. I built this Custom GPT to meet people where they are: ask about goals and gear, compare a few safe paths, and provide clear steps with simple validation and rollback. I also wanted to make sure nontechnical folks feel encouraged, not discouraged, to try.

✅ Friendly tone without fluff. Plain terms, small decisions at a time, and protective guardrails.

👥 Role and Audience

• Who it’s for: Nontechnical homeowners who want dependable results without deep configuration.
• Tone: Friendly, patient, concise. Necessary terms are defined in one short line.
• Encouragement: Reassures, offers alternatives, and avoids dead ends.

🧾 Must Ask First (then it waits for your answers)

1) Outcome: What should happen automatically first?
Examples: text me when laundry is done, lights at sunset, lock at bedtime.
2) Priorities: Pick any two to prioritize now: easy setup, low cost, fast results.
3) What you already have: Devices, hubs, apps, smart speakers. Include brand if known.
4) Networking: Router or mesh brand, guest network or VLANs.
5) Constraints: Budget, privacy preference (local only, cloud OK, hybrid), rental or wiring limits, timeline.

Optional follow-ups if they change the design: reliability/uptime needs and skill comfort (app-only, light config, or OK with Docker/YAML).

🛠️ Working Method

1) Intake - Ask the 3-5 questions above. If gaps remain, at most 2 quick follow-ups.
2) Inventory - Build a concise table of current gear and reuse potential.
3) Verify - Check trusted docs to confirm compatibility, protocols (Matter, Thread, Zigbee, Z-Wave, Wi-Fi), and platform integrations (Home Assistant, Apple Home, Google Home, Alexa, SmartThings).
4) Options - Generate 2-4 viable solution paths within your constraints.
5) Score - For each option, score and sort by your two chosen priorities:

• Difficulty: 1 very easy, 3 moderate, 5 advanced
• Time: 1 under 15 min, 3 about 1 hour, 5 multi-evening
• Cost: 1 no new spend, 3 under $100, 5 $300+
  6) Recommend - Pick the best fit and explain the tradeoffs clearly.
  7) Implement - Numbered steps with exact app paths or commands, validations after each milestone, and simple rollback notes.
  8) Diagram - A compact flowchart of data and control paths.
  9) Next steps - 2-3 small expansions.
  10) References - 3-8 credible sources used, with links.

Safety: No high-voltage or gas/plumbing instructions. For mains power, it defers to a licensed pro. No secrets requested; if keys are needed, it shows how to create and store them safely.

📦 What You Get In Every Plan

• Executive summary with a one-sentence problem statement and a top recommendation.
• Environment snapshot table and Options matrix sorted by your priorities.
• Step-by-step build with validations and rollbacks.
• Mermaid flowchart plus a text-only fallback for accessibility.
• Expansion ideas and a References section with sources used.

🧪 Example Scenario

• Outcome: “Text me when the washer is done, then pause the kids’ Wi-Fi until laundry is unloaded.”
• Approaches offered:
  • Smart plug with energy sensing in Home Assistant (local, reliable).
  • Vendor app or Google Home routine if supported (fast, cloud).
  • n8n workflow that calls router profiles or parental controls (flexible).
• Scoring: Sorted by your choice of easy setup, low cost, or fast results.
• Output: Step-by-step with validations. If a device isn’t compatible, it shows a safe fallback.

🔐 Privacy and Reliability

• Prefers local control when feasible. If cloud is used, it explains what data flows to the cloud and how to limit it.
• Adds retries, timeouts, and health checks where appropriate.
• Labels any unverified assumptions and shows how to verify them.

🗺️ Flowchart (template the assistant includes in plans)

🚀 Try It in ChatGPT

👉 Launch Home Automation Decision Assistant in ChatGPT

💬 Share your outcome and pick any two priorities (easy setup, low cost, fast results). The assistant inventories your gear, verifies compatibility, scores 2–4 options, and returns a step-by-step plan with a flowchart, validation checks, and simple rollback notes.

👉 Watch here: PowerShell Arrays for Beginners

Topics Covered in the Video

• Declare an empty array

  $myArray = @()
  

• Populate the array with strings

  $myArray = "zero", "one", "two"
  

• Access elements by index

  • First element (0), last element (-1), or any position:

    $myArray[0]      # zero
    $myArray[-1]     # two
    

• Select multiple elements

  $myArray[0,2]      # zero and two
  $myArray[1..3]     # one, two, three
  

• Add elements with +=
  (recreates the array each time — fine for small lists)

  $myArray += "three"
  

• Inspect the variable type

  $myArray.GetType()
  

• List available members

  $myArray | Get-Member
  

• Check array length

  $myArray.Length
  

• Clear the array

  $myArray.Clear()
  

• Review and reuse console history

  Get-History      # alias: h
  Invoke-History 3 # alias: r 3
  

• Join array elements into a string

  $joined = $myArray -join ", "
  

• Split a string back into an array

  $newArray = $joined -split ", "
  

Arrays are one of the most common and useful data structures you’ll use in PowerShell scripting—get to know them well. Thanks for watching!

When people say they “work in Identity,” it can mean a lot of different things, and that’s what makes this field both interesting and confusing for those just starting out. Identity and Access Management (IAM) is about making sure the right people and systems have access to the right things, and nothing more. That might sound simple, but in practice it spans everything from handling logins and managing accounts to enforcing security policies across thousands of users and applications.

This post breaks down the types of IAM jobs that exist today; some technical, some operational, some focused on governance or cloud - and outlines what skills are helpful for each. I also included examples pulled from real job listings to show how these roles show up in the wild. If you’re curious about IAM, switching roles, or just figuring out where to start, I hope this gives you a useful jumping-off point.

👥 Workforce vs Customer Identity

The role breakdowns in this article mostly focus on Workforce IAM, which covers access for employees, contractors, service accounts, etc.

Customer IAM (CIAM) involves many of the same tools and titles, but the work is centered on user sign-up flows, privacy, consent, and fraud protection for external users.

I’m not breaking every role out by identity type, but it’s worth knowing the difference as you explore this space.

🔍 A Quick Note on Role Scope

In larger organizations, you’ll often find specialized IAM roles like the ones described below, each focused on a specific area such as governance, engineering, or architecture. In medium or smaller companies, these responsibilities are often combined into hybrid roles. For example, instead of a dedicated Identity and Access Management Administrator, you might see a System Administrator or Cloud Engineer managing access control as part of their broader responsibilities. Job titles and scopes can vary depending on company size, team structure, and priorities.

👩‍💼 Identity and Access Management (IAM) Analyst

Responsibilities:

• User Lifecycle Management: Oversee the creation, modification, and deactivation of user accounts across various systems, ensuring timely and accurate provisioning and deprovisioning.
• Access Reviews and Audits: Conduct regular audits and reviews of user access rights to ensure compliance with internal policies and external regulations.
• Policy Enforcement: Implement and enforce IAM policies, procedures, and controls to maintain security and compliance standards.
• Collaboration: Work closely with IT, HR, and security teams to align IAM processes with organizational needs and to address access-related issues.
• Troubleshooting: Identify and resolve access-related issues, ensuring minimal disruption to business operations.
• Documentation: Maintain up-to-date documentation of IAM processes, configurations, and procedures for audit and operational purposes.

Ideal Background:

• Education: Bachelor’s degree in Computer Science, Information Technology, or a related field.
• Experience: Will vary; typically 2+ years of experience in identity and access management or a related IT security role.
• Technical Skills: Familiarity with IAM tools and platforms (e.g., Active Directory, LDAP, SAML, MFA solutions).
• Analytical Skills: Strong analytical and problem-solving abilities, with attention to detail.
• Communication: Effective verbal and written communication skills, with the ability to convey complex information to non-technical stakeholders.
• Certifications (Optional): Certifications such as CompTIA Security+, vendor-specific IAM certifications from Okta, Microsoft, or similar.

Similar Job Titles:

• Access Management Analyst
• Identity Governance Analyst
• Identity Management Analyst
• Identity and Access Provisioning Analyst
• Identity and Access Business Analyst
• Identity and Access Risk Analyst
• Security Analyst – Identity and Access Management

🛠️ Identity and Access Management (IAM) Administrator

Responsibilities:

• User Lifecycle Management: Manage the provisioning, modification, and deactivation of user accounts across systems, ensuring timely and accurate access control.
• Access Control Implementation: Define and enforce access policies, including role-based access control (RBAC), to ensure users have appropriate permissions.
• IAM System Maintenance: Configure, maintain, and optimize IAM tools and platforms to support authentication, authorization, and directory services.
• Monitoring and Auditing: Regularly monitor system activity, conduct access reviews, and audit logs to ensure compliance with security policies and regulatory requirements.
• Multi-Factor Authentication (MFA): Implement and manage MFA solutions to enhance security for user authentication processes.
• Issue Resolution: Troubleshoot and resolve IAM-related issues, providing support to users and collaborating with IT teams to address access concerns.
• Documentation: Maintain comprehensive documentation of IAM processes, configurations, and procedures for audit and operational purposes.

Ideal Background:

• Education: Bachelor’s degree in Information Security, Information Technology, Computer Science, or a related field.
• Experience: Will vary; typically 3+ years in IAM or related roles, with hands-on experience in user provisioning, access control, and directory services.
• Technical Skills: Proficiency with IAM tools (e.g., Active Directory, LDAP), understanding of authentication protocols (e.g., SAML, OAuth), and familiarity with security frameworks.
• Communication: Strong ability to convey technical information to non-technical audiences and collaborate across departments.
• Certifications (Optional): Certifications such as CompTIA Security+, vendor-specific IAM certifications from Okta, Microsoft, or similar.

Similar Job Titles:

• Access Management Administrator
• Identity Management Administrator
• IAM Systems Administrator
• IAM Operations Administrator
• IAM Support Administrator
• IAM Analyst/Administrator
• IAM Specialist
• IAM Engineer

🔧 Identity and Access Management (IAM) Developer

Responsibilities:

• System Design and Implementation: Design, develop, and maintain IAM solutions that manage digital identities and access rights across the organization.
• Application Integration: Integrate applications and services with identity providers using protocols such as OAuth 2.0, OpenID Connect (OIDC), and SAML to enable single sign-on (SSO) and secure authentication.
• Custom Development: Develop custom scripts and applications to automate identity workflows, including user provisioning, deprovisioning, and access reviews.
• Directory Services Management: Work with directory services like Active Directory and LDAP to manage user information and access controls.
• Security Compliance: Ensure IAM solutions comply with security policies and regulatory requirements, conducting regular assessments and implementing necessary controls.
• Collaboration: Collaborate with cross-functional teams, including security, IT, and application developers, to implement IAM best practices and solutions.
• Troubleshooting and Support: Identify and resolve issues related to identity management systems, providing support for IAM-related incidents and requests.

Ideal Background:

• Education: Bachelor’s degree in Computer Science, Engineering, or a related field.
• Experience: Will vary; typically3+ years of experience in IAM development or a related role, with hands-on experience in designing and implementing IAM solutions.
• Technical Skills: Proficiency in programming and scripting languages such as Python, PowerShell, JavaScript, or Java; experience with IAM tools and platforms; familiarity with authentication and authorization protocols (e.g., OAuth 2.0, OIDC, SAML).
• Security Knowledge: Understanding of security principles and practices, including access control models, encryption, and compliance standards.
• Communication: Strong communication skills to effectively collaborate with technical and non-technical stakeholders.

Similar Job Titles:

• Identity and Access Management Developer
• Identity Management Developer
• Identity and Access Management Software Engineer
• Identity and Access Management Solutions Developer
• Identity and Access Management Integration Developer
• Identity and Access Management Engineer

🔒 Identity and Access Management (IAM) Security Specialist

Responsibilities:

• Threat Identification and Mitigation: Analyze and address identity-related security threats, including unauthorized access and privilege escalation attempts.
• Collaboration with Security Teams: Work closely with red, blue, and purple teams to enhance the organization’s security posture through coordinated efforts.
• Advanced Security Measures Implementation: Deploy and manage advanced security controls for identity protection, such as multi-factor authentication (MFA) and privileged access management (PAM) solutions.
• Audits and Assessments: Conduct regular audits and assessments of IAM systems to ensure compliance with security policies and regulatory requirements.
• Policy Development and Enforcement: Develop, implement, and enforce access control policies and procedures to maintain secure and compliant access to systems and data.
• Incident Response: Participate in incident response activities related to identity and access management, including investigation and remediation of security incidents.
• Continuous Improvement: Stay updated on emerging threats and IAM technologies to continuously improve the organization’s identity security framework.

Ideal Background:

• Education: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Experience: Will vary; typically3+ years in IAM or a similar security role, with hands-on experience in implementing and managing IAM solutions.
• Technical Skills: Proficiency with IAM tools (e.g., Active Directory, LDAP, SAML, OAuth), and understanding of security protocols and frameworks.
• Regulatory Knowledge: Familiarity with regulatory requirements such as GDPR, HIPAA, SOX, and ISO 27001.
• Analytical Skills: Strong analytical and problem-solving abilities, with attention to detail.
• Communication: Effective communication skills to collaborate with cross-functional teams and convey technical information to non-technical stakeholders.
• Certifications (Optional): Certifications such as Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), or vendor-specific IAM certifications.

Similar Job Titles:

• Identity and Access Management Security Specialist
• Identity and Access Management Security Consultant
• Identity and Access Management Security Analyst
• Identity Security Engineer
• Identity and Access Management Governance Specialist
• Identity and Access Management Risk Analyst
• Identity and Access Management Compliance Specialist
• Identity and Access Management Threat Analyst

🧱 Identity and Access Management (IAM) Architect

Responsibilities:

• Architectural Design: Design and implement scalable, secure, and resilient IAM infrastructures that align with organizational goals and regulatory requirements.
• Federated Identity and SSO Strategies: Develop and oversee strategies for identity federation and single sign-on (SSO) to streamline user access across diverse systems and platforms.
• Stakeholder Collaboration: Collaborate with business and IT stakeholders (Information Security, Internal Audit, etc.) to ensure IAM solutions meet current and future business needs.
• Integration of IAM Solutions: Integrate identity management, access management, and governance solutions into existing infrastructures and applications.
• Policy and Compliance Oversight: Establish and enforce IAM policies, standards, and procedures to ensure compliance with industry regulations and best practices.
• Technology Evaluation: Evaluate emerging IAM technologies and recommend solutions that enhance security and operational efficiency.
• Mentorship and Leadership: Provide guidance and mentorship to IAM teams, fostering a culture of continuous improvement and knowledge sharing.

Ideal Background:

• Education: Bachelor’s or Master’s degree in Computer Science, Cybersecurity, Information Technology, or a related field.
• Experience: Extensive experience in IAM architecture, including the design and implementation of complex IAM solutions.
• Technical Proficiency: Deep understanding of IAM protocols (e.g., SAML, OAuth, OpenID Connect), directory services (e.g., Active Directory, LDAP), and IAM tools (Sailpoint, Okta, Entra ID, Saviynt).
• Strategic Thinking: Ability to align IAM strategies with business objectives and adapt to evolving technological landscapes.
• Communication Skills: Strong verbal and written communication skills to effectively convey complex IAM concepts to diverse audiences.
• Certifications (Optional): Certifications such as Certified Information Systems Security Professional (CISSP), Certified Identity and Access Manager (CIAM), or similar credentials.

Similar Job Titles:

• Identity and Access Management Solutions Architect
• Identity and Access Management Technical Architect
• Identity and Access Management Infrastructure Architect
• Identity and Access Management Security Architect
• Identity and Access Management Enterprise Architect
• Identity and Access Management Domain Architect
• Identity and Access Management Systems Architect
• Lead Identity and Access Management Architect

Career Pathways into Identity and Access Management (IAM)

There’s no single way to break into Identity and Access Management (IAM). People arrive here from all sorts of tech backgrounds—whether it’s helpdesk support, system administration, software development, cloud engineering, or cybersecurity.

Some IAM roles are hands-on and technical, others are more strategic or compliance driven. Many blend both. The good news? You don’t need to follow a rigid path. Whether you’re starting out or pivoting from another IT role, there are multiple ways to grow into an IAM career.

In the sections below, I’ll cover potential routes into IAM and how your existing skills can help you get there.

Note: These pathways are illustrative and not exhaustive. Individual journeys into IAM can vary based on personal interests, organizational needs, and emerging technologies.

🛠️ IT Support & Helpdesk

Starting Roles:

• Helpdesk Technician
• IT Support Specialist

Transition Path:

• Helpdesk Technician → Identity and Access Management Analyst: Building upon experience in resolving user access issues to managing and auditing access controls and policies.

Key Skills:

• User account management
• Basic understanding of access controls
• Familiarity with directory services like Active Directory

🖥️ Systems & Infrastructure

Starting Roles:

• System Administrator
• Infrastructure Engineer

Transition Path:

• System Administrator → Identity and Access Management Administrator: Building upon experience in system management to oversee identity systems and implement access controls.

Key Skills:

• Directory services management
• Understanding of network protocols and security
• Experience with server and infrastructure management

☁️ Cloud & DevOps

Starting Roles:

• Cloud Engineer
• DevOps Engineer

Transition Path:

• Cloud Engineer → Identity and Access Management Engineer: Integrating IAM solutions within cloud platforms and managing cloud-based access controls.

Key Skills:

• Cloud platform proficiency (e.g., AWS, Azure, GCP)
• Infrastructure as Code (IaC) tools
• Automation and scripting

👨‍💻 Software Development

Starting Roles:

• Software Developer
• Application Developer

Transition Path:

• Software Developer → Identity and Access Management Developer: Developing and integrating identity solutions within applications, focusing on authentication and authorization mechanisms.

Key Skills:

• Programming languages (e.g., Python, Java, PowerShell)
• Understanding of authentication protocols (e.g., OAuth 2.0, SAML, OpenID Connect)
• API integration

🔐 Cybersecurity

Starting Roles:

• Security Analyst
• Information Security Specialist

Transition Path:

• Security Analyst → Identity and Access Management Security Specialist: Focusing on identity-specific threats and implementing security measures within IAM frameworks.

Key Skills:

• Risk assessment and mitigation
• Compliance and regulatory knowledge (e.g., GDPR, HIPAA)
• Security auditing and monitoring

🧩 Cross-Functional Transitions

IAM roles often require collaboration across various IT domains. Professionals may find themselves transitioning into IAM from roles that overlap multiple areas:

• IT Project Manager → Identity and Access Management Program Manager: Overseeing IAM projects and aligning them with organizational goals.

• Business Analyst → Identity and Access Management Business Analyst: Analyzing business requirements to inform IAM solutions and policies.

By understanding these pathways, professionals can identify how their current roles and skills align with opportunities in IAM and plan their career development accordingly.

🧭 Conclusion

Identity and Access Management (IAM) isn’t confined to a single career trajectory. Whether you’re just starting out or considering a specialization, there are multiple avenues to explore. From roles in IT support and systems administration to positions in cloud computing, software development, and cybersecurity, IAM offers diverse opportunities. Each individual’s journey is unique, so it’s essential to assess your interests and skills to determine the path that aligns best with your career goals.

Players take on executive roles—like CEO, CISO, or CFO—and respond to a simulated breach over a series of turns. The game is based on real-world incidents and focuses on how decisions are made, what’s at stake, and how different roles within a business react under pressure.

🎯 Goal: You don’t win. You learn what can go wrong when teams misalign or under-communicate.

💡 Why I Built It

Most security tabletop exercises are overly technical or compliance-focused. They often miss the human and organizational elements—like miscommunication, competing priorities, or executive pressure.

This game flips the script. It focuses on leadership dynamics during crisis:

⚖️ A Legal Officer may prioritize liability. A CISO may prioritize stopping the breach. Both are “right”—but those differences affect outcomes.

🕹️ How It Works

• The game is turn-based. Each round introduces a new twist in the cyber incident.
• Players make decisions with limited time and incomplete information.
• Each role has unique objectives that may conflict with others.
• Real-world inspiration comes from events like the SolarWinds hack or the MGM ransomware attack.
• After play, you get a written debrief summarizing outcomes and alternate paths.

🧠 It’s designed to spark discussion—not just test knowledge.

👥 Ways to Use It

• Solo — Explore breach scenarios or prep for your own tabletop at work.
• Team Play — Assign CXO roles to coworkers and walk through a breach together.
• Learning Tool — Great for understanding how legal, technical, and business decisions intersect during an incident.

📢 Perfect for tabletop first-timers or folks who want to see what executive crisis response actually looks like.

🚀 Try It in ChatGPT

I built a custom GPT that runs the game, acts as the Incident Master, and guides gameplay:

👉 Launch Cyber Crisis: A CXO’s Quest in ChatGPT

💬 Ask it questions. Push its logic. Step out of the checkbox.
The more creative you get, the more dynamic the session becomes.

🔧 Agent Instructions (for ChatGPT GPT Builder)

Below are the prompt instructions I used to build it. Feel free to tinker and build your own!

You are a specialized GPT designed to assist in designing, refining, and running **Cyber Crisis: A CXO’s Quest**—a cybersecurity-themed tabletop role-playing game modeled after Dungeons & Dragons. The game supports 1 to 8 players, each roleplaying as a Chief Officer (CEO, CIO, CISO, CFO, COO, CMO, CHRO, CLO) of a fictional enterprise facing escalating cyber threats. One player acts as the Incident Master (IM), guiding the narrative and adjudicating outcomes like a Dungeon Master.

🎯 Primary Functions:
- Help design game mechanics, CXO role cards, threat scenarios, industry packs, and decision systems.
- Act in two modes:
  - 🛠 **Design Mode**: Brainstorm and refine rules, character systems, and educational outcomes.
  - 🎭 **Live Play Mode**: Serve as the Incident Master (IM), narrating the session, presenting threats, facilitating decisions, and resolving actions with immersive storytelling.
- Ensure all enterprise scenarios are grounded in realistic, current cybersecurity threats. Use the MITRE ATT&CK framework and high-profile cyber incidents (fictionalized) as inspiration.

---

## 🧱 Core Game Concepts:

### 🎯 Session Objectives:
- Reveal blind spots in decision-making, escalation, and communication.
- Simulate the high-stakes world of cyber crisis management at the executive level.
- Reinforce strategic trade-offs, real-world limitations, and urgency.

---

### 🧨 Scenario Structure:
Every scenario includes:
- **Trigger**: Entry vector (e.g., phishing, supply chain compromise, misconfiguration)
- **Indicators of Compromise** (IOCs)
- **Escalation Path**: Lateral movement, persistence, or extortion
- **Impact Zones**: Data, operations, finances, brand, compliance
- **Resolution Paths**: Contain, disclose, negotiate, remediate

Use **probabilistic threat modeling**:
- Assign escalating probability ranges (e.g., 10%, 30%, 60%) for attacker progression.
- The longer an indicator or threat is ignored, the higher the success chance for the attacker’s next move.

Introduce a **Crisis Curve Timer**, reflecting stages of a breach:
- T1: Initial Detection  
- T2: Attacker Movement  
- T3: Exfiltration or Extortion  
- T4: Reputational or Legal Fallout  

Player actions delay or accelerate curve progression.

---

### 🧑‍💼 CXO Roles:
Each Chief Officer has:
- **Primary Stat**: Functional strength (e.g., CFO = Budget, CHRO = Morale)
- **Passive Trait**: Ongoing bonus  
- **Power Card**: A one-use high-impact strategic move  
- **Dice Modifiers**: For or against various decision types  
- **Asymmetric Objective**: Private CXO win condition that may conflict with others

Examples:
- CISO: Prevent persistent access  
- CFO: Keep response under $1M  
- CLO: Avoid regulatory disclosure  
- CMO: Restore public trust to 8+  

This models executive misalignment during real-world crises.

---

### 💼 Resource Management:
Players manage limited:
- **Time**: Decisions must be made within turns
- **Budget**: Allocate toward defense, legal, comms, or upgrades
- **Staff Capacity**: Reflects burnout, attrition, or misallocation

Players must weigh trade-offs. **Delayed action increases attacker success odds** and introduces **Risk Debt**—unaddressed issues that reappear in later turns.

---

### 🎲 Decision System:
Use dice or fate-based systems:
- Standard rolls: 50%, 75%, or 90% success chance  
- Modifiers: Role alignment, preparation, inter-CXO conflict  
- Outcomes: Critical Success, Success, Partial Success, Failure, Critical Failure

---

### 📊 Trust & Influence Meters:
Track dynamic values affected by player decisions:
- **Public Trust**
- **Board Confidence**
- **Regulatory Attention**
- **Employee Morale**

Actions by CXOs directly affect these. Consequences occur when thresholds are crossed:
- Trust < 3 → PR Crisis  
- Board Confidence < 2 → Forced Resignation Vote  
- Regulatory Attention = MAX → Surprise Audit  
These drive realism and increase pressure as the game progresses.

---

### 📢 Communication Dynamics:
Encourage realistic tension:
- **Intel Asymmetry**: Only some CXOs have full visibility
- **Side Conversations**: Backchannels, secret alliances, or legal shielded discussions
- **Role Friction**: Simulate internal disagreement (e.g., CISO vs CLO over breach disclosure)

---

### ❌ Failure Is Valid:
Failure is encouraged when justified. Reflect consequences such as:
- Revenue loss  
- Lawsuits  
- Long-term brand damage  
- Increased scrutiny from board or regulators

Make space for player reflection: “Why did we fail?”

---

### 📅 End-of-Game Reporting (AAR):
At the end of a session, generate a professional After-Action Report:
- 📍 Timeline of threat evolution  
- 🧠 CXO actions and reasoning  
- 🔥 Impacts (data loss, financial, operational, brand)  
- 📚 Lessons learned (link to MITRE ATT&CK where relevant)  
- 📈 Delta: Risk posture from Turn 1 vs Turn 10  
- 🧭 Team Alignment Score  
- 🚨 Missed Opportunities & Ideal Paths  
- 🧠 *Real World Parallels*: At the end, describe a real incident this scenario mirrors and what was done differently (or worse) in reality.

---

### 🧘 Leadership Reflection (Optional):
Offer prompts between rounds or at the end of play:
- “What policy would you propose after this incident?”
- “Which team decision do you most disagree with, and why?”
- “What would you do differently in your real-world role?”

These encourage professional growth and internalization.

---

### 🏭 Industry Customization Packs:
Adapt scenarios and mechanics per industry vertical. Each has unique assets, risks, and external pressures.

- **Healthcare**: PHI, ransomware prioritization, HIPAA  
- **Finance**: Insider trading, SOX, real-time payment risks  
- **Media**: Talent leaks, brand risk, reputational volatility  
- **Retail**: PCI scope, fraud vectors, supply chain  
- **Education**: Student data, old systems, limited budget  

Scenarios should reflect vertical-specific tension, attacker motives, and regulatory sensitivity.

---

### 🧠 Guiding Principle:
Your job is to teach *strategic decision-making under fire*, modeled through the lens of executive cyber crisis response.  
Always prioritize realism, urgency, collaboration, trade-offs, and consequences.  
This is not about being perfect—it’s about surfacing what goes wrong in the real world, and why.

Active Directory Hardening Series - Part 1 – Disabling NTLMv1

NTLMv1, an outdated authentication protocol, is vulnerable to various attacks. Transitioning to NTLMv2 enhances security by providing stronger encryption and better resistance to attacks.

Active Directory Hardening Series - Part 2 – Removing SMBv1

SMBv1, introduced decades ago, lacks modern security features and is susceptible to multiple vulnerabilities. Eliminating SMBv1 reduces the attack surface. This process includes auditing current SMB usage, identifying dependencies, and systematically disabling SMBv1 on all systems.

Active Directory Hardening Series - Part 3 – Enforcing LDAP Signing

LDAP traffic, if unsigned, can be intercepted or tampered with, posing significant security risks. Enforcing LDAP signing ensures the integrity and authenticity of LDAP communications. This measure involves configuring domain controllers to require LDAP signing and ensuring all client applications support and implement LDAP signing.

Active Directory Hardening Series - Part 4 – Enforcing AES for Kerberos

Kerberos, a cornerstone of AD authentication, traditionally used the RC4 encryption algorithm, which is now considered weak. Enforcing AES encryption for Kerberos tickets enhances security by utilizing stronger cryptographic methods. This transition requires updating account encryption settings and ensuring all systems and applications support AES.

Active Directory Hardening Series - Part 5 – Enforcing LDAP Channel Binding

LDAP channel binding adds an extra layer of security by binding the TLS tunnel to the LDAP session, mitigating man-in-the-middle attacks. Implementing this involves configuring domain controllers to require channel binding tokens and updating clients to support this feature.

Active Directory Hardening Series - Part 6 – Enforcing SMB Signing

SMB signing ensures that SMB communications are authenticated and that their integrity is verified, protecting against tampering and certain types of relay attacks. Enforcing SMB signing involves configuring both clients and servers to require signed SMB communications.

Active Directory Hardening Series - Part 7 – Implementing Least Privilege

Adopting the principle of least privilege involves granting users and services only the permissions necessary to perform their tasks, minimizing potential attack vectors. This practice includes regular audits of user permissions, reducing the number of privileged accounts, and implementing role-based access controls.

Protecting yourself online can feel challenging at times, but there’s an approach that works well and is used by businesses everywhere: Defense in Depth. Think of it like peeling an onion; security comes in layers, and each one adds extra protection against threats.

This guide provides useful insights and actionable tips to help you enable security features and adopt a security-first mindset at every layer of your digital life.

1. Physical Security

Purpose: Protect your physical devices from theft or tampering.

Imagine losing your phone or laptop. Your photos, bank details, and passwords could all be at risk if someone else gets your device. Physical security is about protecting the “front door” to your device so strangers can’t just pick it up and access your life.

How to Protect Yourself:

• Use device locks (PINs, passwords, or biometrics like fingerprints or facial recognition). This prevents unauthorized people from unlocking your device. Avoid easy codes like “1234” or birthdays, and don’t reuse device PINs/passwords across different devices.
• Never leave devices unattended in public places, and be mindful of shoulder-surfing (someone looking over your shoulder). Opportunistic thieves can quickly snatch or peek at an unprotected device.
• Enable device tracking and remote wipe so you can locate or erase your device if it’s lost or stolen. For example, smartphones and laptops offer features to find a lost device or wipe its data remotely.

Platform-Specific Tips

• Windows: Set up Windows Hello for biometric sign-in (fingerprint or face). This adds secure, convenient access to your PC.
• Apple (iPhone/iPad/Mac): Enable Apple’s Stolen Device Protection (on iPhone with iOS 17.3 or later) to add an extra layer of security when your device is away from trusted locations. Also, turn on Face ID or Touch ID on your iPhone, iPad, and Mac for quick biometric unlocking. Be sure to enable Find My on all your Apple devices to locate, lock, or erase them remotely if needed.
• Android: Set a strong screen lock on your phone (PIN or biometrics). Keep Find My Device enabled to help locate or remotely secure your phone if it goes missing.

2. Network Security

Purpose: Safeguard your devices from unauthorized access and attacks, especially when they’re online.

Think of your home Wi-Fi like the door to your house. You wouldn’t leave it wide open, right? Network security ensures only trusted people and devices can use your internet. This protects not just your connection but everything connected to it — from your smart TV to your work emails.

How to Protect Yourself:

• Secure your Wi-Fi network: Change the default administrator password on your home router to a strong, unique password. Also use a strong Wi-Fi network key with modern encryption (WPA2 or WPA3) so only authorized people can connect.
• Keep your router updated: Regularly install your router’s firmware updates from the manufacturer. Updates fix security weaknesses and improve protection.
• Enable firewalls: Use the built-in firewall on your computers (e.g. enable Windows Defender Firewall or the macOS firewall) to block unwanted incoming connections. These help shield your devices from network-based attacks.
• Be cautious on public Wi-Fi: Public hotspots (like those in cafes or airports) are not secure. Avoid accessing sensitive accounts or information on public Wi-Fi, or use a trusted VPN service if you must use those networks.

3. Identity and Access Management (IAM)

Purpose: Make sure only you can access your accounts and personal information.

Imagine someone pretending to be you online; they could open credit cards in your name or even lock you out of your own accounts. IAM is like showing ID on the internet. It ensures only the real you can log in or make important changes to your accounts.

How to Protect Yourself:

• Use strong, unique passwords: Create passwords that are long (at least 12 characters) and hard to guess. Use a mix of unrelated words or a passphrase. Never reuse passwords across different accounts — if one account is breached, you don’t want the same password to unlock others.
• Use a password manager: A password manager can generate and securely store complex passwords so you don’t have to remember them all. Many phones and browsers have one built-in (like the Passwords app for iPhone), or you can use trusted apps like 1Password, Keeper, or Bitwarden.
• Consider single sign-on (SSO): Using options like “Sign in with Apple,” “Sign in with Google,” or “Sign in with Microsoft” can be convenient and secure. These big providers invest heavily in security and it reduces the number of passwords you need to manage.
• Freeze your credit: This prevents anyone from opening new financial accounts in your name. It’s a free service you can activate with the credit bureaus and greatly reduces the risk of identity theft.
• Enable multi-factor authentication (MFA): MFA adds an extra verification step (like a code on your phone or a fingerprint) when logging in. Even if someone steals your password, they can’t get in without that second factor. According to Microsoft, accounts with MFA enabled are 99.9% less likely to be compromised.

Not all login methods are equal. The table below shows common authentication methods ranked by security strength. Try to use the stronger methods (toward the top of the table), especially for accounts with sensitive information like finances or personal photos.

4. Application Security

Purpose: Ensure the apps and software you use are safe and don’t misuse your information.

Have you ever downloaded an app and thought, “Why does it need access to my camera or contacts?” Application security is about trusting the tools on your phone or computer. We want to be sure the apps we install (like banking apps or social media) aren’t leaving us exposed to malware or privacy invasions.

How to Protect Yourself:

• Keep your apps updated: Updates often include security fixes. Set your phone and computer to update apps automatically, if possible, so you always have the latest protections.
• Keep your operating system updated: When your device prompts you to install an update (especially a security update), do it promptly. These patches fix known vulnerabilities that attackers could exploit.
• Download apps from official sources: Stick to trusted app stores (the Apple App Store, Google Play Store, or Microsoft Store). Avoid downloading software from random websites, since it could hide viruses or spyware.
• Review app permissions: Check what data and features your apps can access (location, contacts, camera, microphone, etc.). If something seems unnecessary for an app’s function, revoke that permission. For example, a simple flashlight app shouldn’t need to see your contacts.
• Use antivirus/anti-malware protection: Make sure you have security software active on your devices. For Windows, the built-in Microsoft Defender (Windows Security) provides solid antivirus protection. Mac computers have built-in malware protections as well. These tools can help catch and remove malicious software if it slips onto your device.

Platform-Specific Tips

• Windows: Use the Microsoft Store to install apps whenever possible, since apps there are vetted for security.
• Apple: Download software from the App Store or from trusted developers only. On Mac, check your System Settings > Privacy & Security for App Permissions to control which programs can access sensitive information (files, camera, microphone, etc.). On iPhone, you can use Safety Check (in Settings) to review what data is being shared with others and quickly reset permissions if needed.
• Android: Keep Google Play Protect on (it’s enabled by default in the Play Store settings) to automatically scan your apps for harmful behavior. Avoid “sideloading” apps (installing from outside the Play Store) unless you absolutely trust the source.

5. Cloud & Data Security

Purpose: Safeguard your personal files and information from loss, theft, or unauthorized access.

Your data holds precious memories and essential information. Data security means protecting important files (like family photos or critical documents) so they remain safe and accessible even if your device is lost or stolen. Cloud security extends this protection to your online life by securing backups, emails, and files stored in cloud accounts — keeping your information private no matter where it lives.

How to Protect Yourself:

• Enable device encryption: Turn on full-disk encryption on your devices. This scrambles your data so that only someone with the right key (your password, PIN, or fingerprint) can read it. For example, Windows offers BitLocker and macOS has FileVault to encrypt your device’s storage.
• Back up your data: Regularly back up important files and photos. Cloud backups (like OneDrive, iCloud, or Google Drive) can automatically save copies of your data, or you can use an external hard drive. Backups ensure that if your device crashes or is stolen, you don’t lose everything.
• Secure your cloud accounts: Protect the accounts that hold your online data (email, cloud storage, etc.) with strong passwords and MFA (as discussed above). Take advantage of extra security settings available from providers. For instance, Google’s Advanced Protection Program offers additional safeguards for Google accounts that are at higher risk, requiring a physical security key and limiting third-party access.

Platform-Specific Tips

• Windows: Enable BitLocker on compatible Windows PCs to encrypt your hard drive, so your data remains locked without your login. Also, use OneDrive (built into Windows) or another trusted cloud service to automatically back up important folders like Documents and Photos.
• Apple: Turn on FileVault on your Mac to encrypt all data on the disk. (For iPhones and iPads, device data is automatically encrypted when you use a passcode.) Use iCloud Backup on your iPhone/iPad to save your device settings, photos, and messages to iCloud, making it easy to restore if you get a new device. On Mac or PC, use iCloud Drive to securely store and sync files across your devices. Apple’s optional Advanced Data Protection for iCloud can extend end-to-end encryption to more of your iCloud data, meaning only you (with your devices) can access that information.
• Google/Android: Make sure your Android phone’s built-in Google Backup is turned on (this will back up things like contacts, photos, and app data to your Google account). If you need the highest level of security on your Google account, consider enrolling in Google’s Advanced Protection Program. It requires using physical security keys and blocks untrusted apps from accessing your Google data, giving you strong protection against account hijacking.

6. Monitoring and Logging

Purpose: Stay aware of what’s happening with your accounts and devices.

Think of monitoring your accounts like having a security camera for your digital life. It helps you catch suspicious activity early. If someone is trying to access your account or something isn’t right, you can spot it and take action before too much damage is done.

How to Protect Yourself:

• Use breach notification services: Sign up for a service that alerts you if your email address or personal data appears in a known data breach. For example, the free site Have I Been Pwned can notify you if your email or phone number was exposed in a data leak, so you can promptly change passwords and secure those accounts.
• Regularly check account activity: Take advantage of tools that show you where and when your accounts have been accessed. For instance, you can view the list of devices logged in to your Apple ID, review recent security events on your Google account, or check the login history on your Microsoft account. Make a habit of checking these for your important accounts (email, social media, banking). If you ever see a login or device that you don’t recognize, secure that account immediately by changing your password and removing that unknown device from your account.
• Monitor your credit and financial statements: Review your bank and credit card statements and credit reports regularly for any unusual activity. Many banks and credit bureaus offer free alerts or monitoring services that will flag new accounts or large transactions. Early detection of identity theft can save you a lot of trouble.

7. Incident Response and Recovery

Purpose: Be ready to handle security problems quickly and bounce back if something goes wrong.

Think of this like having a digital first-aid kit. Despite all your precautions, accidents happen — a hacker might slip through, or you might lose a device. Incident response and recovery is about having a plan so that one breach or mistake doesn’t derail your digital life. It’s how you respond to issues and recover afterward.

How to Protect Yourself:

• Keep backups for emergencies: If ransomware locks your files or your hard drive fails, having recent backups (as mentioned in Cloud & Data Security) means you can restore your important data and carry on with minimal interruption.
• Know how to recover accounts and devices: Take some time to learn the recovery options for your devices and accounts. For example, know how to reset your Apple ID or Google account password if you get locked out, and how to remotely lock or erase a lost phone. When trouble strikes, you’ll be able to act faster instead of scrambling to figure it out.
• Have a plan for identity theft: If your identity or accounts are compromised, time is critical. Know which banks, credit card companies, or other institutions you would need to contact to freeze accounts or cards. You can also report identity theft and get a personalized recovery plan from an official resource like IdentityTheft.gov (a U.S. government site). Having a list of steps to take will help you stay calm and organized during a stressful event.

Final Thoughts

This may seem like a lot to take in, but you don’t need to do everything at once. Start by choosing the most important areas for you and implement those security measures first. Over time, layer on more defenses as you become comfortable. By gradually applying these layers of defense, you’re not just reacting to threats but proactively protecting yourself.

No single security step is foolproof, but together they make you a much harder target. Stay alert for phishing or scam attempts (like suspicious emails or texts that try to trick you), because even the best locks won’t help if you accidentally let the thief in the door! Keep learning about new tools and best practices, stay vigilant, and you’ll significantly enhance your personal digital security.

But first (IYKYK); a little bit of background…

I began posting on TikTok on October 30, 2023, after discovering the “TechTok” community—a engaging, organically formed group of tech enthusiasts spanning various disciplines, including Information Security, Networking, Cloud Engineering, DevSecOps, Infrastructure, and Sales Engineering. This welcoming community actively interacted with one another through comments, shares, and stitches of tech-related videos.

My objectives as a creator were:

1. To network with like-minded individuals
2. To participate in tech-related memes
3. To share valuable insights on Identity and IT
4. To enhance my public speaking skills

Before I share some fun metrics; please know that I was quite literally “winging it” and honestly that’s what made this fun. Youtube and IG feel very polished and have often have decent production value. As I consider increasing my presence on these platforms, I feel the need to produce more refined content. While becoming an influencer isn’t my goal, reaching like-minded individuals is essential for rebuilding a sense of community.

Here are some fun metrics I screenshot before the service went down:

Tip: Click the image to expand!

Profile Stats:

Follower Stats:

Viewer Stats:

My Most Popular Videos:

Stats on my most popular video:

I hope to continue the connections I’ve made along the way on any platform that will have us. It’s critically important to have a group in your industry or field where you can bounce questions off of each other, discuss challenges, and sometimes just vent. Having a support network is invaluable in both personal and professional growth.

If you’ve ever thought about posting content to social media, regardless of your field, I encourage you to do it—start yesterday! When I look back at my first video, it’s hands-down the cringiest thing I’ve ever recorded. But hey, we all have to start somewhere. My friends would probably still say I’m cringey, but you know what? That’s just me. 😄

Why, hello there!

I’ve seem to have stumbled upon an area of interest (at least for now) in the TikTok community. That area happens to be one of my favorite tools: PowerShell!

Recorded Videos

Here are some videos I’ve recorded so far:

Part 1: Introduction to the “CLIP” Command

The goal for this video was honestly to show off the CLIP command, and everything preceding it was completely ad-libbed. It turns out a lot of people were interested in seeing more!

Watch Part 1 on YouTube

Part 2: PowerShell Aliasing

In this video, I specifically cover Aliasing in PowerShell to address some comments about the verbosity of the tool.

Watch Part 2 on YouTube

Part 3: PowerShell (What is $_ ?)

In this video, we dive into the basics of PowerShell, specifically focusing on the $_ symbol. These are essential when working with objects in a pipeline, especially when processing arrays or handling errors in a try-catch block.

Watch Part 3 on YouTube

Get Involved

If you are reading this and want to see anything specifically covered within PowerShell, please feel free to leave a comment on the YouTube video. I’ll do my best to cover everything that I am familiar with and can.

Thanks!

P.S. I’ll eventually spend some time on proper video thumbnails. 🙂

I actually didn’t know who Kelsey Hightower was before this podcast. I learned about him through Gerald Yerden, who I was fortunate enough to find on TikTok and Youtube.

There are 3 parts to this interview that I have listened to at least a dozen times already.

➡ 30:23 - “Separating yourself from the crowd”

Disclaimer: Everyone’s career and situation is different and none of this is meant to be prescriptive.

I really enjoyed listening to this part because I could see similarities in what I did in my own career (and continue to do).

• Continuously grow and learn! You may not need to use the skill immediately, but you never know when the opportunity can arise where it can provide value.
• Surround yourself with people who will give you honest feedback!
• “Don’t be safe”: If you’re not putting yourself out there, it’s hard to showcase the skills you’ve learned. This is actually a big part of why this blog and my public social media presence now exists.

➡ 55:10 - “AI: What it is, isn’t, and could be”

I hadn’t heard this correlation before, and I thought it was brilliant. You’ll have to watch the video for this one because I won’t do the segment justice in a blog post.

➡ 01:29:45 - “How do you retire early? Tech Lottery Tickets” which leads into examples: ➡ 01:32:59 - “Kelsey’s Career”

My absolute favorite quote, “It doesn’t often pay off in real time, so we think it’s a waste of time”. I swear when I heard this, I was taken aback the same way Gerald was. 😂

YouTube Video: