Johnny Beverton
In this episode, Mathieu Ahlstrom, Business Unit Manager for Identity in the Netherlands at IdentIT, joins Empiric's Ruby Tucker from our IAM and PAM Cybersecurity desk to discuss identity and access management, team design and the future skills identity leaders need to prioritise.
Mathieu came to IAM through an unusual route, having landed in identity after a long career at IKEA spanning multiple functions. He has since led identity programmes and scaled delivery teams across complex organisations, saying "I don't think anyone really chooses for this profession. It chooses you”.
Watch the video for his sharp and practical take and read the full recap, below.
TLDR: Key Takeaways from the Conversation
- IAM is a people discipline first - the biggest misconception is treating it as a purely technical function when the work centres on human identities and business outcomes.
- When building from scratch, anchor the team with a business analyst at the ground level and an architect who can speak to leadership - then fill delivery capacity once a programme exists.
- Soft skills determine whether identity teams scale. A collaborative mid-skill engineer who asks questions will outperform a brilliant isolate who cannot work with others.
- Offshore team success depends on integration and respect - teams that feel part of the organisation deliver better results and are sharper on preventing security breaches.
- The product mix in IAM will change completely in the next five years. Hiring managers should prioritise risk thinking, adaptability and communication over specialism in any single vendor tool.
- Invest in training now. The ROI may not be immediate, but identity managers who delay will regret it within two years.
Why Is IAM a People Problem Rather Than Just a Technology Issue?
Identity and Access Management is fundamentally about managing people and business processes, not just implementing security technology.
According to Mathieu, "One of the biggest misconceptions about identity and access management is that it's a technology practice. A hundred percent. And it's actually people first. It's right in the name - identity and access management. You're dealing with human identities and you're dealing with a business."
He explains that IAM teams do not sit adjacent to the business, "We are the user and we are the business. And I think it's often underestimated how much people work is actually a big part of being successful in identity and access management."
That misunderstanding plays out directly in hiring, “You don’t want to ask an architect to go and do click work, and you don’t want to ask a business analyst to go and talk to your CISO.”
How Do You Build an IAM Team When There Is No Programme Yet?
When building IAM teams from scratch, organisations should start with strategic leadership and business alignment before expanding delivery roles.
When building identity teams from scratch, Mathieu starts with maturity, "Does an organisation understand what they want from their identity system - what they actually want to achieve?"
If clarity is missing, he anchors the function at the top and bottom simultaneously, "Have a business analyst who can actually socialise requirements, get them in from the business, and an architect who's able to speak with the C-level, the CSO, with the CFO, and help these from the ground insights actually be understood by the leadership so they can put together a programme."
Where a programme already exists, the full four-role model comes into focus, "An architect is going to give you your long-term roadmap. A product owner is going to give you a stack - identity governance, privileged access management. An engineer is going to build what the product owner says they need to have built and a business analyst is going to make sure all the requirements are fed in."
The balance shifts depending on where you are on the roadmap, but the underlying requirement stays constant, "What you basically want is to have folks in there who understand this interaction between the people, the process, and the technology that they're implementing, and whatever knowledge you need to have at that moment to make the next step."
Why Are Soft Skills Critical for Scaling IAM Teams?
Soft skills such as collaboration, communication and stakeholder engagement are essential for IAM teams to scale effectively.
Mathieu does not separate technical depth from behavioural capability, "Everybody needs them," he says when asked who requires soft skills. He recalls working with engineers who could build entire identity applications but struggled to collaborate, "That creates problems of scale. So that's an army of one. If you actually run an identity programme, you need to be able to scale up and scale up and scale up. And that requires people being able to work together."
He would hire collaboration over raw technical ability, "I would rather have a really collaborative but maybe mid-skill engineer who has still maybe a lot to learn but isn't afraid to ask a colleague for help, isn't afraid to say 'I'm going to go talk to that stakeholder because I'm not sure I understood that requirement'." The payoff is concrete, "Maybe they need twice as long to build it, they're going to do it in a way that's long-term successful. And they're going to be the one that gets the call from that stakeholder who remembered that they got asked the question."
The same standard applies to architects. They must defend strategy without alienating stakeholders, "There's a fine line between defending the roadmap and being an arrogant SOB," he says, half-joking, recalling projects that lost entire quarters of productivity because one architect appeared "a little bit snooty".
"It's not enough to be able to know all the protocols. You need to make sure that all the people who are paying for it, who are using it, understand it, and that your colleagues who are helping you achieve the results are buying into it as well."
How Do Offshore IAM Teams Influence Security and Delivery?
Offshore IAM teams can deliver strong results, but success depends on integration, collaboration and mutual respect.
Team composition extends beyond seniority. Many organisations rely on offshore identity teams to scale delivery.
"The mix is contextual," Mathieu says. Cost pressures often drive offshore decisions, but delivery success depends on integration.
"The best offshore teams that I've worked with were the ones who were open to actually connecting on more than just the work." He made that investment himself, discussing collaborating with a team in India, "We went over to their side actually. I visited them a couple of times to make sure that we had a good team connection there. The other way around, they came out to visit us." The result was that boundaries dissolved, "The offshore team felt as committed to our result as if they were actually on our payroll."
When that respect is absent, the consequences are immediate. Mathieu has seen the other side, "I've worked with in-house teams who, to phrase it delicately, had mixed opinions about offshore teams and as a result they just wouldn't even bother." His response is blunt, "If you disrespect those tools, your own delivery will suffer."
The security dimension also matters - and it is one hiring managers rarely factor into team integration decisions. Offshore identity teams often manage sensitive credentials, "If you bring them along, if they feel they were a part of your company, they will be more motivated to be sharp on preventing those breaches."
What Skills Will IAM Professionals Need in the Next Five Years?
Future IAM professionals will need adaptability, risk thinking and communication skills rather than deep expertise in a single vendor platform.
The conversation rounded out returning to skills development and giving people room to grow.
"There is nobody, absolutely nobody, who knows everything they need to know about today and they certainly need to learn about tomorrow."
The pressure on that point is increasing, “We are at an inflection point right now where AI is coming in. The nature of threats is changing, and I know my vendors are going to hate me when I say this, but the product mix that people are going to need in the next five years is going to change completely.”
That shift has direct consequences for how careers in IAM have been built, "We have got some really big incumbents who are big in the marketplace right now, and we have got individuals who have built their whole careers by being a specialist in a product. What we need going forward are folks who are skilled in thinking about risk, who are skilled in thinking about how organisations are going to grow with their identity and access management needs - and actually, how do you make people happy with it? Right back to those soft skills."
His advice to identity managers is to invest in training now and absorb the short-term uncertainty that comes with it, “It is not, you are not going to see the ROI on it right away, maybe. If you don’t do it today, you are going to worry. You are going to be sad that you didn’t two years from now.”
The practical instruction that follows is direct, “Stop worrying about ‘is it Ping, is it SailPoint, is it Saviynt’. Start thinking more about your risks and thinking about how does your team move with you to be there? For what? To be the shape that you need to be in two or three years time.”
Build Your Identity Team with Empiric
If you are building an identity and access management team, hiring IAM or PAM specialists or are a cybersecurity professional looking for your next role, our IAM and PAM desk works exclusively in this space. Get in touch with Ruby and the team today.
Be sure to connect with Ruby and Mathieu on LinkedIn to continue the conversation. Mathieu regularly posts about identity governance, non-human identities and building IAM teams - follow him on LinkedIn here and if you're in the market for identity consultancy, you can book time with him directly via his profile.
Be sure to follow us on LinkedIn and sign up to our newsletter to stay in the loop on what's next.
