I am an identity and access management specialist, an area of technology which has good reasons for being a niche specialisation, as do many other other technology areas. But you can imagine my surprise at receiving this unsolicited email from a recruiter:
“My client, a leading British Bank, require a Role Based Access ControlManager to join their offices in Edinburgh on a 6 Month Contract basis with the possibility of extension.
The RBACM will help design the Role Based Access for technology partners throughout my client’s Separation and Business Proving stages, all the way through to transitioning the service to BAU functions. It’s important to note that this role is a Technical ‘Hands-On’ role which also requires Project Management capabilities and the ability to plan.”
Let’s begin with the meaningless drivel, the kind many supposed HR experts suggest we fill our CVs with. Beginning with ‘technical hands-on’ and ‘management’. What usually happens when you follow these self-professed career gurus and add such an inane line to you CV is that a firm looking for a technical role will think you’re not technical enough: who has met a project manager who had the time to get ‘hands-on’ in a multi-million dollar project? Also, requesting that a candidate ‘has the ability to plan’ is just insulting.
Now on to the central issue with this role, role-based access control (RBAC) is one of the many skills an experienced IAM consultant acquires in the course of their career. Every organisation is different, there is no RBAC school or certification, just as there are no IAM schools. Working in IAM requires you continuously keep several key questions in mind in every project: ‘who are you?’, ‘what is your relationship to the organisation?’, ‘what are you allowed to access?’ and how to always be able to monitor that the answers to these questions, defined by business rules, can be continuously monitored and irregularities rapidly identified and remediated.