Identity governance specialists who've run the platform in production.
Demand Cyber places identity governance specialists on contract and permanent terms. Every engineer is tested on SailPoint, Saviynt or Microsoft Entra ID Governance in a live sandbox by a CISSP-certified practitioner before you see a CV. We also place access management and privileged access specialists.
What does an identity governance specialist do?
They control who gets access to what when people join, change role or leave, and prove it at audit time. Day to day, that means building connectors, writing provisioning rules and running access certification campaigns.
It takes its data from HR and answers to your auditors. When it's set up badly, leavers keep access and the same audit findings come back each year.
How does identity governance work across the lifecycle?
Access is granted when someone joins, adjusted when they move and removed when they leave, with regular reviews to catch what slips through. A governance platform automates each step from your HR data and keeps the evidence.
Which identity governance platforms do you cover?
SailPoint Identity Security Cloud (formerly IdentityNow) and IdentityIQ, Saviynt and Microsoft Entra ID Governance, plus Omada, One Identity and Okta Identity Governance. Each candidate is tested on the platform and version you run.
| Platform | Skills we test in the sandbox |
|---|---|
| SailPoint Identity Security Cloud | Transforms, cloud rules, Workflows, connector configuration, ISC APIs, access profiles and roles |
| SailPoint IdentityIQ | BeanShell rules, custom tasks and workflows, XML objects, Lifecycle Manager, upgrades and patching |
| Saviynt Enterprise Identity Cloud | Connector JSON, SQL-based analytics, separation of duties rulesets and workflows |
| Microsoft Entra ID Governance | Lifecycle Workflows, access packages, Access Reviews, Privileged Identity Management, Graph API |
| Omada and One Identity Manager | Data model and connectivity, Synchronization Editor, VB.NET and SQL scripting |
| Oracle and IBM (legacy) | Connectors and adapters, mostly for migration to a modern platform |
| And More | Ask us about platforms not listed here. |
Which identity governance roles can you fill?
Build engineers and migration leads, plus the architects, analysts and programme managers who work alongside them.
Do you place access management and single sign-on specialists?
Yes. Most of this work comes from Okta and Microsoft Entra ID consolidations, ADFS decommissions and passwordless rollouts. Candidates troubleshoot SAML and OIDC sign-in flows in the sandbox.
| Platform | Skills we test in the sandbox |
|---|---|
| Okta Workforce Identity | Policies and network zones, Okta Workflows, SCIM provisioning, Terraform for Okta |
| Microsoft Entra ID | Conditional Access design, app SSO with SAML and OIDC, token lifetimes, Entra Connect |
| Ping Identity (incl. ForgeRock) | PingFederate, PingOne and Advanced Identity Cloud |
| Customer identity | Auth0 and Entra External ID: login, registration, consent and social login at scale |
| ADFS and SiteMinder (legacy) | Migration to Okta or Entra ID |
| And More | Ask us about platforms not listed here. |
Do you place privileged access management engineers?
Yes. CyberArk and BeyondTrust lead in regulated sectors. CyberArk is now part of Palo Alto Networks and is still sold on its own. Candidates onboard accounts and build connectors in a sandbox vault.
| Platform | Skills we test in the sandbox |
|---|---|
| CyberArk Privilege Cloud / Self-Hosted | Vault, PVWA, CPM, PSM and PSMP, connector development, REST API bulk onboarding |
| BeyondTrust | Password Safe smart rules, Privileged Remote Access jump points, Endpoint Privilege Management |
| Delinea | Secret Server and Privilege Manager |
| Secrets management | HashiCorp Vault and CyberArk Conjur: auth methods, policies, dynamic secrets |
| And More | Ask us about platforms not listed here. |
How do you vet identity governance specialists?
Every identity governance specialist we put forward has passed four screening stages run by CISSP-certified practitioners. In the sandbox stage, they build and fix rules, workflows and connectors on your governance platform.
Of everyone we source, 42% pass the credential and background check, 18% pass the sandbox deep-dive, 6% pass the practitioner panel and about 1% are cleared for placement. See how we vet or view a sample candidate report.
What does this look like in practice?
One financial services client brought us in after their SailPoint IdentityIQ upgrade had stalled twice.
“Our SailPoint IdentityIQ upgrade had stalled twice. Their contractor had it back on track in a month. He had clearly done this exact upgrade before.”
Can I hire an identity governance specialist on contract or permanently?
Both. A contractor suits an upgrade or rollout with a deadline, and many are available within one to two weeks of the scoping call. A permanent hire suits owning the platform long term.
Permanent hires are fee-based, with a replacement guarantee. Contract Placement · Permanent Hire · Advisory & Workshops
Common questions.
How quickly can a SailPoint contractor start?+
Many of our contractors are available within one to two weeks of the scoping call. You see a vetted shortlist within days.
Can you help with a stalled SailPoint upgrade?+
Yes. We put forward engineers who've done the same upgrade before, and the sandbox exercise includes upgrade work.
Can you move us from IdentityIQ to Identity Security Cloud?+
Yes. We place migration leads who have moved IdentityIQ estates to Identity Security Cloud, and specialists who move legacy Oracle or IBM platforms to SailPoint or Saviynt.
What if I don't have the budget for an onshore resource?+
Our Global & Blended Teams option pairs an onshore lead with vetted engineers in our talent hubs in the Philippines, Vietnam and Singapore. You keep a local point of contact at a lower blended day rate, and every engineer passes the same practitioner vetting. See Global & Blended Teams
Need an identity governance specialist?
Book a 30-minute scoping call. You'll speak to a practitioner, not a recruiter.