Identity governance analysts decide, and prove, who should have access to what, yet the role is rarely explained outside job adverts that mix it up with IAM engineering and help desk work. The job is advertised as identity governance analyst, IGA analyst, access governance analyst, access review analyst, IAM analyst or a named product analyst when an employer runs one platform. It sits between HR, application owners, audit and the identity engineering team, and it rewards people who can read data, follow a control and explain a decision in writing. This guide covers what the role does day to day, the skills and tool categories employers test for, routes in, the certifications that help and how the career progresses. It is for help desk staff, auditors, business analysts and junior security staff considering identity work, and for managers building an IGA team. For the wider field, see the Cybersecurity Careers Guide; this page goes deeper on governance only.
Key takeaways
- The job is a control owner's job. Joiner, mover and leaver processing, access reviews and segregation of duties exist to meet controls such as NIST SP 800-53 AC-2 and ISO/IEC 27001:2022 Annex A 5.18, and every analyst action leaves evidence an auditor may test.
- Data skills matter more than coding. Most of the work is reconciling HR records, account lists and entitlements, which needs spreadsheets, SQL and a habit of checking joins before trusting a report.
- Common entry points are help desk, audit and business analysis. Help desk staff know account lifecycles, auditors know controls and evidence, and business analysts know how to get application owners to answer.
- Non-human identities are now in scope. Service accounts, API keys and AI agents need owners, reviews and leaver handling too, and analysts who can govern them stand out.
- The path branches into engineering, architecture or risk. Typical progression runs from analyst to senior analyst or IGA lead, then into IGA engineering, identity architecture or identity risk and programme leadership.
What the role does
Identity governance and administration (IGA) is the set of processes that grant, change, review and remove access across an organisation's applications and infrastructure. The IAM and IGA Basics guide explains the discipline. An analyst runs those processes and keeps the evidence that they work.
| Area of work | Typical tasks | Output an employer will look for |
|---|---|---|
| Joiner, mover, leaver (JML) | Check HR triggers flow into provisioning, fix failed provisioning, chase leaver removals, remove access left behind after role changes | Leaver removal within the policy deadline, and a falling count of mover access left in place |
| Access requests | Review requests, check approvals and policy, route to the right owner, handle exceptions | Request turnaround time and an exception register |
| Access reviews (certifications) | Build review campaigns, choose reviewers, chase completion, check that revocations actually happened | Completed campaigns with revocation evidence |
| Segregation of duties (SoD) | Maintain conflict rules, investigate violations, record mitigating controls and approvals | A current SoD rule set and a violation log with decisions |
| Application onboarding | Collect entitlement lists, owners and descriptions; agree review frequency and risk rating with the business | Applications under governance, each with an owner and described entitlements |
| Data quality and reconciliation | Match accounts to identities, find orphaned and dormant accounts, correct attribute errors | Correlation rate and orphan account count |
| Audit support | Produce populations and samples, answer control walkthroughs, close findings | Audit findings closed without repeat |
A typical week mixes routine and investigation: a morning on failed leaver tickets, an afternoon persuading an application owner to describe 300 entitlements, and a reconciliation that turns up accounts nobody can explain. Title shifts the balance. An analyst runs the processes; an IGA engineer builds connectors, workflows and integrations; an identity architect sets the target model. The IAM Engineer Career Guide covers the engineering branch.
Core skills and tools
Governance knowledge
- Lifecycle processes: how HR events drive account creation, change and removal, and where they fail (contractors outside HR, rehires, role changes without a mover event). See the Joiner-Mover-Leaver Guide.
- Access reviews: manager versus owner reviews, risk-based frequency, reviewer fatigue and rubber stamping, and evidence of revocation. See the Access Reviews Guide and the Access Review Checklist.
- Roles and entitlements: role-based access control, birthright access, role mining and an entitlement catalogue that business users can understand. See the Role Mining and Role Design Guide and the Entitlement Catalogue Guide.
- Segregation of duties: toxic combinations such as raising and approving a payment, and the difference between preventive and detective SoD. See the Segregation of Duties Guide.
- Non-human identities: owners, purpose and review for service accounts, API keys, OAuth applications and AI agents. See the Identity Governance for AI Agents Guide.
Control language
Analysts are asked to show which control an activity meets. These are the references that come up most often:
| Activity | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Account creation, change and review | AC-2 Account Management | PR.AA-05 | 5.16 Identity management, 5.18 Access rights |
| Least privilege and entitlement review | AC-6 Least Privilege | PR.AA-05 | 5.15 Access control, 5.18 Access rights |
| Segregation of duties | AC-5 Separation of Duties | PR.AA-05 | 5.3 Segregation of duties |
| Leaver processing | PS-4 Personnel Termination | PR.AA-05 | 5.18 Access rights, 6.5 Responsibilities after termination or change of employment |
| Mover processing | PS-5 Personnel Transfer | PR.AA-05 | 5.18 Access rights |
| Ownership of governance roles | (programme level) | GV.RR Roles, Responsibilities, and Authorities | 5.2 Information security roles and responsibilities |
Financial services and listed companies add regulatory drivers. In the US, internal control over financial reporting under the Sarbanes-Oxley Act makes user access reviews on finance systems a recurring audit test, so many analysts spend a quarter of the year on them. The security reason is just as concrete: unreviewed access becomes the valid accounts attackers reuse (MITRE ATT&CK T1078 Valid Accounts).
Data and technical skills
- Spreadsheets and SQL: lookups, pivots, joins and deduplication; the ability to explain why two account lists disagree.
- Directory basics: Active Directory and cloud directory groups, nested groups, attributes and how applications consume them.
- Provisioning standards: what SCIM, LDAP and REST connectors do, enough to read an error and raise a precise ticket. See the SCIM Provisioning Guide.
- Reporting: building dashboards on review completion, leaver timeliness and orphan accounts that a non-technical owner can act on.
- Light scripting: PowerShell or Python for bulk checks is a plus, not a requirement, at analyst level.
Tool categories you will meet
| Category | What it does | What the analyst does with it |
|---|---|---|
| IGA platform | Aggregates accounts and entitlements, runs requests, workflows, reviews and SoD rules | Configure campaigns, investigate correlation failures, approve and audit requests |
| HR system of record | Source of joiner, mover and leaver events and attributes | Check trigger quality, chase missing data for contractors |
| Directory and access management | Holds groups and authenticates users | Read group membership, confirm removals took effect |
| IT service management | Tickets for manual provisioning and exceptions | Track disconnected applications and fulfilment evidence |
| Identity security posture and analytics | Finds risky, dormant and excessive access | Feed findings into reviews and clean-up |
| GRC platform | Holds controls, tests and findings | Map evidence to controls and close findings |
Employers often ask for experience on the IGA platform they run. Platform skills transfer well because the concepts are the same: identities, accounts, entitlements, roles, policies and campaigns.
Routes into the role
| Starting point | What you already bring | Gaps to close |
|---|---|---|
| IT service desk or access administration | Account lifecycle, groups, ticket discipline | Control language, review design, data reconciliation |
| IT or internal auditor | Controls, sampling, evidence standards | Directory and provisioning mechanics, platform configuration |
| Business or data analyst | SQL, reporting, stakeholder management | Identity concepts, access control principles |
| HR systems or HRIS analyst | Source data, organisational structures, worker types | Downstream provisioning, access reviews, SoD |
| GRC or compliance analyst | Frameworks, risk language, findings management | Hands-on identity tooling |
| Graduate | Fresh technical basics and willingness to learn | Workplace process experience; look for identity operations graduate schemes |
A practical nine month plan
- Months 1 to 3: learn the vocabulary. Read the IDPro Body of Knowledge sections on lifecycle and governance, and map your current job's tasks to NIST SP 800-53 AC-2 and AC-6.
- Months 3 to 6: do governance work where you are: reconcile one application's accounts against HR data, list orphaned accounts, or help run a quarterly access review. See the Orphaned and Dormant Accounts guide.
- Months 6 to 9: take one IGA platform's free or entry training, then write up results as numbers (accounts removed, applications onboarded, review completion raised) and sit a certification that fits your level.
The NIST NICE Framework provides a common language for cybersecurity work roles, tasks, knowledge and skills. Mapping your experience to its terms helps when a public sector or large employer writes job descriptions in that language.
What interviews test
- A reconciliation exercise: two lists, HR and application, and a question about which accounts should be removed and why.
- A scenario: a manager approves everything in a review in four minutes; what do you do?
- A conflict: an application owner refuses to describe entitlements; how do you get the work done?
- Control knowledge: what evidence proves a leaver lost access within policy?
Certifications that help
No single certification defines an identity governance analyst. Employers usually combine platform training with a broader identity, audit or security credential. The options below are listed alphabetically; order is not a ranking. See the Identity Certifications Guide for the full landscape.
| Certification | Body | Facts from the body's site (checked November 2026) | When it helps |
|---|---|---|---|
| CIDPRO (Certified Identity Professional) | IDPro | Vendor-neutral IAM knowledge; exam fee USD 750 with member discounts; USD 50 practice exam | Shows identity breadth beyond one product; a good first identity credential |
| CISA (Certified Information Systems Auditor) | ISACA | Five domains, from the information systems auditing process to protection of information assets; experience must be demonstrated in an application after the exam | For analysts on the audit and controls side, or moving towards identity risk |
| CISSP (Certified Information Systems Security Professional) | ISC2 | Requires five years of relevant work experience | Later in the career, for senior, lead and architect roles |
| IGA platform certifications | Platform vendors | Administrator, implementer and engineer tracks vary by vendor | When applying to an employer that runs that platform |
Check fees, format and prerequisites on the certifying body's own site before booking, because they change. The CISSP Certification Guide covers that route in depth.
Progression
| Stage | Typical titles | What changes |
|---|---|---|
| Entry | Access administrator, IAM operations analyst | Fulfil requests and leavers, fix provisioning errors, support reviews |
| Analyst | Identity governance analyst, IGA analyst, access review analyst | Run campaigns, investigate SoD, onboard applications, support audits |
| Senior or lead | Senior IGA analyst, IGA lead, access governance manager | Own the review and SoD programme, set policy, report metrics to risk committees |
| Engineering branch | IGA engineer, IAM engineer | Build connectors, workflows and role models |
| Architecture or risk branch | Identity architect, identity risk manager | Target state across human and non-human identity; see the Security Architect Career Guide and the Cybersecurity Risk Manager Career Guide |
| Leadership | Head of identity, identity programme manager | Budget, team and risk ownership across IAM, IGA and PAM |
Pay
Official statistics do not track identity governance analysts separately. The closest US occupation in the Bureau of Labor Statistics Occupational Outlook Handbook is information security analysts, with a median annual wage of USD 129,180 in May 2025, 192,900 jobs in 2025 and projected growth of 21% from 2025 to 2035. Treat this as a broad benchmark, not an IGA salary: many entry identity roles sit below it, and pay varies by country, sector and seniority.
Specialisms that open up
- Non-human identity governance: ownership, review and decommissioning for service accounts, secrets and AI agents; see the NHI and Machine Identity Engineer Career Guide.
- Privileged access: reviews and lifecycle for administrators; see the PAM Engineer Career Guide.
- Role engineering: role mining and role model ownership in large estates.
- Identity audit and assurance: testing identity controls from the second or third line; see the Cybersecurity Auditor Career Guide.
Signs you are progressing
- Auditors accept your review and leaver evidence without follow-up questions.
- You have redesigned a review campaign so reviewers revoke access instead of approving everything.
- Application owners come to you to onboard, rather than you chasing them.
- You report measurable trends: leaver timeliness, orphan accounts, revocation rate and SoD violations.
Practitioner checklist
- Learn the JML lifecycle end to end, including contractors, rehires and role changes.
- Map your current tasks to NIST SP 800-53 AC-2, AC-5, AC-6, PS-4 and PS-5 and ISO/IEC 27001:2022 Annex A 5.18.
- Practise reconciliation in a spreadsheet or SQL: match accounts to identities and explain every mismatch.
- Run or support one access review and verify that every revocation actually happened.
- Learn one SoD rule set from your organisation's finance or payment processes.
- Add service accounts, API keys and AI agents to your idea of governance scope, with owners and review dates.
- Complete one IGA platform's entry training and one vendor-neutral credential that fits your level.
- Keep a record of outcomes as numbers for your CV and interviews.
Standards and references
- NIST: SP 800-53 Rev 5 Security and Privacy Controls (AC-2, AC-5, AC-6, PS-4, PS-5)
- NIST: Cybersecurity Framework 2.0
- NIST: NICE Framework Resource Center
- ISO: ISO/IEC 27001:2022 Information security management systems
- IDPro: CIDPRO Certified Identity Professional
- ISACA: CISA Certified Information Systems Auditor
- ISC2: CISSP
- US Bureau of Labor Statistics: Information Security Analysts, Occupational Outlook Handbook
Related NHI Mgmt Group resources: IAM and IGA Basics, Access Reviews Guide, Joiner-Mover-Leaver Guide, Identity Governance Maturity Model, IAM Engineer Career Guide.