Three tiers of restriction
The most restrictive tier is classified government work, where clearance eligibility is a hard prerequisite and sponsorship is not a relevant question. The middle tier covers federal contractors and critical infrastructure operators handling controlled unclassified information, where citizenship or permanent residency may be required for specific systems even without a formal clearance. The least restrictive tier is commercial enterprise security — banks, healthcare networks, technology firms, retailers — where sponsorship is common and clearance is irrelevant.
The commercial tier is by far the largest, and it is where most identity engineering work lives. That is fortunate, because IAM skill is highly transferable across it.
Reading a job posting accurately
Postings use shorthand that is worth decoding. 'Must be a US person' typically signals export-control obligations. 'Active clearance required' means the constraint is immovable. 'Clearance eligibility preferred' sometimes means a hiring manager copied a template. 'No sponsorship available' is a budget or policy decision rather than a legal one, and occasionally changes for a scarce specialisation.
When the language is ambiguous, the fastest route is a direct question early in the process rather than an assumption in either direction.
Building a career in the commercial tier
Regulated commercial industries reward identity expertise heavily and rarely impose citizenship constraints. Financial services need segregation-of-duties enforcement and audit-ready access certification. Healthcare needs minimum-necessary access controls across clinical systems. Software vendors need customer-facing identity, tenancy isolation and machine-to-machine authentication.
Depth in these environments compounds. An engineer who has survived a regulatory examination of their access-certification evidence is valuable to every peer institution in the sector.
The longer arc
Immigration status is not permanent. Engineers who obtain permanent residency and later citizenship become eligible for the restricted tiers, and by then they usually hold a decade of enterprise identity experience that clearance-holding generalists lack. Treating the commercial tier as a foundation rather than a consolation is the strategically correct read.
In the meantime, the right filter is simple: pursue depth where the door is open, and revisit the closed doors when status changes.
Key takeaways
- Clearance eligibility and work authorization are separate constraints — confirm which one applies.
- Most enterprise IAM work sits in the commercial tier, where sponsorship is common.
- Decode posting language early rather than assuming; some phrasing is template inertia.
- Commercial depth becomes an asset if status later opens restricted-tier roles.
Hiring or being hired in IAM?
TagWin Recruiting places Okta, Ping, SailPoint and CyberArk specialists with enterprises that cannot afford an identity gap.
Start an intake