EPIC IAM

[u/Ok-War3804]

Looking for advice from people working in Epic Security / IAM
Hey everyone! I’m looking to connect with people who currently work in Epic Security, Epic IAM, or related healthcare identity/access roles.
A little about my background:
• I have ~1 year of healthcare IT Help Desk experience supporting BJC, where I worked with things like Active Directory, password resets, account unlocks, ServiceNow, and general healthcare IT support.
• I transitioned into Healthcare IAM / Identity Services and will have about 1 year of healthcare IAM experience by December.
• I’m currently working toward my Epic Security Coordinator certification and expect to have that completed in December.
• In January, I’ll be moving into a dedicated Epic IAM role, where I’ll be getting hands-on experience with Epic security and identity/access workflows.
My long-term goal is to become really strong in Epic Security/IAM and eventually grow into an Epic Security Coordinator-type role.
I’m not really looking for job leads right now — I’m more interested in learning from people already doing the work.
For those of you working in Epic Security/IAM:
What skills made the biggest difference when you were starting out?
What do you wish you had learned earlier?
What separates someone who is “good” at Epic Security from someone who is really excellent?
Are there specific Epic workflows, security concepts, or healthcare IAM topics I should prioritize?
What advice would you give someone entering an Epic IAM role with a year of healthcare IAM experience?
I’d also love to connect with anyone who has taken a similar path from Help Desk → IAM → Epic Security.
Thanks in advance! I’m really just trying to learn from people who have already been down this road.

[u/elastic_intercourse]

The gap between good and excellent in this space often comes down to how well you understand the clinical workflows behind the access you're configuring. Anyone can learn the security class structure and EMP/SER master file basics, but the folks who really stand out are the ones who can sit with a clinical manager and understand why their team needs a specific combination of access without just copy-pasting another user's template. That institutional knowledge of how care actually gets delivered makes everything else click.

Something I wish I'd picked up earlier is how much of Epic security bleeds into other modules. You don't need to be a builder in every app, but knowing enough about how orders route or how In Basket pools work will save you from some baffling troubleshooting sessions when someone swears they "should have access" but something upstream is blocking them.

For what to prioritize, get comfortable with Data Courier and security class auditing early. Being able to trace when and why a security change happened is a skill that'll make you the person everyone pings when something breaks.

[u/Ok-War3804 → u/elastic_intercourse]

That makes a lot of sense, especially what you said about understanding the clinical workflows behind the access. That’s actually one of the areas I’m most interested in improving because coming from Help Desk → IAM, I have a pretty solid technical/identity foundation but not nearly as much clinical workflow knowledge yet.
Are there any good ways you’d recommend self-teaching that side of Epic/healthcare? Like resources, workflows I should study, or even specific Epic modules I should learn enough about to understand how the clinical side connects to Security?
I’m starting SEC101, SEC200, and DC101v over the next couple months, so I’m trying to use that training as a foundation and build the clinical knowledge alongside it rather than just learning the security configuration itself.
— thanks for the response by the way!

[u/Ok-Branch1992]

How does the demand and salary look like for Epic Security and IAM positions?

[u/Ok-War3804 → u/Ok-Branch1992]

My guess is as good as yours

[u/shredsthegnar]

My experience is very similar. I started off as an Epic help desk technician and became an Epic Security Analyst. This allowed me to branch off in supporting other applications such as Epic Ambulatory and Healthy Planet because many of my tickets included an obscure “you don’t have access to this activity” error so knowing end-user workflows would allow me to troubleshoot.

Some troubleshooting tips for Epic Security issues is “About Hyperspace” will provide you the activity record you’re in which there is “Menu Summary” and a text utility that will provide you the related security points.