Identity & Privileged Access
Identity Governance & Access Review
Where identity meets audit. The archetype most exposed to rubber-stamping, and the one with the clearest metric for whether it is working.
Identity governance owns the question an auditor asks and most organisations cannot answer: who has access to what, why, and who said so? The tooling — SailPoint, Saviynt, Okta Identity Governance — exists to make that answerable at scale.
The problem that defines the role
The standard control is a periodic access review: send each manager a list, ask them to confirm. It fails predictably. A manager facing four hundred entitlements with cryptic technical names and a deadline approves all of them. That is rubber-stamping, and a rubber-stamped review is worse than no review, because it produces documentary evidence of a control that is not operating — which is exactly what an auditor will rely on.
The metric that tells the truth
Not completion rate. Revoke rate. A campaign that revokes nothing is not evidence of a clean estate; it is evidence that nobody read it. If your quarterly privileged campaign closes at 100% completion with a 0.4% revoke rate, the control is decorative.
Bringing that distinction unprompted is the fastest way to establish credibility in this interview, because everyone in the room has run a campaign that closed at 100% and meant nothing.
The decisive round
“Our access reviews are rubber-stamped. Fix it.”
Interviewer: “Managers approve everything. Completion is 98%. What do you do?”
A weak answer. “I'd communicate the importance of the review, provide training on how to assess entitlements, and escalate managers who approve without reviewing.” Treats rational behaviour as a discipline problem. The manager is responding correctly to an impossible task, and training does not make four hundred cryptic entitlements reviewable in the time available.
A strong answer. “The behaviour is rational, so I'd change the task rather than exhort the reviewers.
Review by exception. Do not show the full list. Show what changed since last time and what has not been used. A manager can decide on twelve items; they cannot decide on four hundred.
Lead with usage data. ‘These thirty entitlements have not been used in 180 days’ is a decision a human can make. ‘Is this appropriate?’ is not, because they genuinely do not know what most of them do.
Translate the names. Half the problem is that entitlements are called things like SAP_FI_GL_POST_02. Mapping technical entitlements to business-readable descriptions is unglamorous and it is the single biggest lever on review quality.
Invert the default. Unused access is revoked unless someone acts, with a one-click path to reclaim it. That converts inertia from an enemy into an ally.
Then replace review with expiry where possible — time-bounded grants expire without anyone deciding, which is strictly better than an unreliable human control.
And I'd report revoke rate rather than completion rate, and expect it to look bad initially. A campaign that suddenly revokes eight percent after years of revoking nothing is not a new problem; it is the old problem finally becoming visible.”
Whether you fix the system or blame the users, and whether you know completion rate is a vanity metric. The entitlement-naming point is what marks real experience.
- Build a usage-informed review. Take any system with access logs, produce a list of entitlements unused in ninety days, and format it as a decision a manager could make in five minutes.
- Write an SoD ruleset as forbidden pairs, and be able to explain the compensating control when the business genuinely needs an exception.
- Have a preventive-versus-detective position. Checking at request time so the toxic combination never exists beats finding it in a campaign three months later, and saying so signals you understand what the control is for.
Compensation
| Market | Band | Notes |
|---|---|---|
| United States | $130k – $220k base | SailPoint and Saviynt engineering skills carry a premium |
| India | ₹15L – ₹45L total | One of the largest identity job markets globally, driven by BFSI GCCs |
The book for this field
Identity & Access
Authentication versus authorisation, federation, the joiner-mover-leaver lifecycle, entitlements, privileged access, secrets, and machine identity.
Also read for this role
Microsoft 365 & Copilot in the Enterprise
How a Microsoft 365 estate is actually built, licensed and governed — tenant, identity, workloads, devices, Purview and Defender, every licence tier with current prices, and then Copilot and Copilot Studio from the request path to the evidence on whether they deliver.
All 12 chapters in Microsoft 365 & Copilot in the Enterprise →
Cross-cutting
Skills every archetype tests
These are shared across every field on this site — the same question asked in different vocabulary — so preparation here compounds rather than being spent once. The book above is specific to your field.
Practice the 11 Identity questions → · Back to Identity & Privileged Access →