Identity & Access Management (IAM) Analyst

Real portfolio pieces built during the course, not a certificate for its own sake. Each one is work you can show.

• Access decision recordOne page per non trivial request: what was asked for against what the person actually needs to do, what they already hold, the segregation rules tested and the conflict found, the options weighed, who approved it, when it expires, and anything you noticed on the way that was raised separately.
• Joiner, mover and leaver runbookThe lifecycle written so somebody else can run it: populations and their triggers, the joiner and mover steps with who decides, the leaver sequence in the order that works and why it is that order, the surfaces your directory cannot see, how each step is verified, and the gaps stated honestly.
• Role definition and segregation matrixOne role defined properly: the job it serves in a sentence, the entitlements in it with the reason for each, the entitlements deliberately excluded, the owners on both the business and technical side, and a segregation matrix with the risk in plain words and the number of people currently in breach.
• Access certification campaign reportA campaign written up for somebody who was not there: scope and what was left out, a participation table with median seconds per item beside the completion figure, reviews judged unreliable and what you did about them, revocations decided against revocations executed, exceptions with risk owners, and what changes next quarter.
• Privileged access registerEvery privileged and non human identity in one table: owner and deputy, standing or just in time, how old the credential is, whether a person can sign in as it, whether anybody would be alerted if they did, and when it was last reviewed. Filled in from the simulation, including the account nobody owns.
• Federation trust recordEvery federated application in one table, filled in from the outage: how each one learns the identity provider's signing key, what its own sign on diagnostics actually said, what that evidence rules out and what it cannot tell you, the faster fix that was refused and the one sentence why, and an owner and an expiry for every certificate somebody pastes in by hand. Including the one whose expiry nobody knows.