SailPoint IIQ Job Roles Explained
Definitions, Examples, and Learning Paths for IdentityIQ Professionals
In the SailPoint IdentityIQ (IIQ) ecosystem, responsibilities are generally divided into
three main pillars: Development, Administration, and Support. An
Implementation role typically requires mastery across all three. Below is a
breakdown of the specific tasks within each role, what they mean, and what you
need to learn to master them.
1. Implementation (The Full-Stack Expert)
Definition: An implementation engineer or architect is responsible for the end-to-end
deployment of SailPoint IIQ from scratch. This role combines Development,
Administration, and Support skills.
Example: A company buys SailPoint, and the Implementation Engineer designs the
architecture, writes the custom code, configures the servers, and hands it off to the
support team.
What to Learn: You must learn the entire SailPoint lifecycle. Start by mastering
Administration, move into Development, and understand the infrastructure (Tomcat,
MySQL/Oracle, Linux) required to host the application.
2. Development (The Builders)
Custom Rules
Explanation: Writing custom code (usually in Java or BeanShell) to override default
system behavior. SailPoint provides standard logic, but large enterprises always need
custom logic for specific edge cases.
Example: Writing a "BuildMap" rule that takes raw HR data and converts it into
standard SailPoint identity attributes (e.g., converting "Dept_123" to "Finance").
What to Learn: Core Java, BeanShell scripting, SailPoint Object Model (knowing how
Identity, Link, and Application objects interact in the code).
Configure Custom Workflows
Explanation: Designing the step-by-step logic and routing for automated processes,
like access requests or approvals.
Example: Creating a workflow that says: "If a user requests VPN access, route it to their
Manager. If approved, route it to IT Security. If approved again, automatically provision
the access."
What to Learn: SailPoint XML structure, Workflow transitions, Workflow Variables,
and integrating scripts inside workflow steps.
Configure LifeCycle Events (JML)
Explanation: Automating what happens when an employee Joins, Moves, or Leaves
(JML) the company.
Example: Configuring a "Leaver" event so that the moment HR changes a user's status
to 'Terminated', SailPoint instantly disables their Active Directory account and emails
their manager.
What to Learn: Identity Triggers, Business Processes, and Provisioning Plans.
Customization
Explanation: Modifying the user interface (UI), creating custom forms, or building
bespoke connectors for legacy applications that don't have out-of-the-box support.
Example: Adding a custom logo to the login screen and creating a custom dropdown
form for the "Request Access" page.
What to Learn: XHTML, CSS, Apache Velocity (for email templates), and advanced Java
for custom connector development.
3. Administration (The Operators)
Application Onboarding
Explanation: The process of connecting SailPoint to target systems (like Active
Directory, Workday, Salesforce) so it can read and manage data.
Example: Entering the IP address, service account credentials, and search bases into
the SailPoint UI to connect to an LDAP directory.
What to Learn: SailPoint Connector configurations, understanding Application
Definitions, Correlation rules, and Networking/Firewall basics.
Configuration of Certifications
Explanation: Setting up "Access Reviews" where managers must verify if their
employees still need the access they currently have.
Example: Scheduling a quarterly "Manager Certification Campaign" that sends an email
to all managers asking them to approve or revoke access for their direct reports.
What to Learn: Certification Campaigns, Continuous Certifications, and Exclusion
Rules.
Policy Violation
Explanation: Creating Separation of Duties (SoD) policies to ensure users do not get
conflicting, dangerous access combinations.
Example: Setting up a rule that flags an alert if a user is given both "Accounts Payable"
and "Vendor Creation" access in SAP.
What to Learn: Advanced Policy configuration, Preventive vs. Detective SoD, and
mitigating controls.
Installation & Patching
Explanation: Managing the actual software binaries, installing SailPoint on servers,
and applying security patches or version upgrades.
Example: Upgrading SailPoint IIQ from version 8.2 to 8.3 during a scheduled weekend
maintenance window.
What to Learn: Apache Tomcat administration, Database management (MySQL/
Oracle/SQL Server), command-line Linux, and the SailPoint IIQ console (`iiq console`).
4. Support (The Maintainers)
Troubleshooting
Explanation: Investigating and fixing errors when things don't work as expected in
production.
Example: A user complains they didn't get their requested access. Support checks the
SailPoint logs, finds a "Network Timeout" error, and resubmits the provisioning task.
What to Learn: Log4j configuration, reading application logs (syslog, tomcat logs),
and debugging object locks.
Monitoring
Explanation: Ensuring the SailPoint environment is healthy, background tasks are
completing on time, and servers aren't running out of memory.
Example: Checking the "Task Results" page every morning to ensure the nightly HR
aggregation didn't fail.
What to Learn: Task scheduling, system health dashboards, and JVM memory
management.
Reporting & Advanced Analytics
Explanation: Generating data extracts to prove compliance or provide insights to
leadership.
Example: Running an out-of-the-box report to show all "Orphaned Accounts" (accounts
active in AD but belonging to a terminated user).
What to Learn: IIQ Reporting framework, JasperReports, and custom SQL queries for
direct database extraction.
Incident Management
Explanation: Handling support tickets (usually from ServiceNow or Jira) raised by end-
users regarding identity issues.
Example: Resolving a ServiceNow ticket titled "Urgent: Unlock my account" by finding
the user in SailPoint and triggering a password reset/unlock workflow.
What to Learn: ITIL processes (incident vs. problem management) and utilizing the
SailPoint Helpdesk UI.