Companies hire access review engineer help when the campaign tool is already purchased and the review still does not finish. The seat in an identity governance product gives you a queue, a reminder, and connectors for the directories it ships with. Microsoft documents that product surface for Entra in access reviews. The engineer builds the three pieces the seat does not finish for a mid-market SOC 2 program: entitlement ingest from the systems you actually run, a close rule that refuses a pending item, and a revoke that calls the API and checks the grant is gone.
Rutagon does that build. Another IGA seat adds a login for a person who will still export the internal admin tool by hand. The diagnostic we start with lists the sources, the items that have no decider, and the revoke decisions that never left the spreadsheet. Build versus buy for access review automation is the framing for that choice. This article is the job description if the build is the path you take.
What you hire access review engineer time to build
Ingest is the population. An item the reviewer cannot see will not be decided, and it will still be granted. The engineer writes a collector per source: IAM Identity Center permission sets, Entra groups and roles, the GitHub organization, the data warehouse grants, the internal admin database that has an is_admin column. Each record has the same shape so the campaign does not care which API it came from.
ingest: source, account, entitlement, subject, collected_at
close: item, decision, decider, reason, closed_at
revoke: item, api, request_id, recheck_at
close_blocked_if: any item pending, or revoke without request_idThe hard collector is the one with no SCIM endpoint and no documented report. That is the billing admin tool, the support console, the feature-flag service. The engineer reads the table or the API the app already has, maps the flag to an entitlement name a manager understands, and schedules the extract. A connector marketplace that does not list that app leaves the app out of the review. The hire is how it gets in. IGA consulting is the surrounding engagement. The deliverable here is the extract, on a schedule, with a schema the campaign can load.
Duplicates are part of ingest. The same person can hold the same admin right through a group and through a direct assignment. Two rows are correct. One collapsed row hides the path you failed to remove. The engineer keeps the path on the record. Reviewers see both, or they see one row that explains both paths. They do not see a merged "has access: yes" with no source.
Collected_at is on every record. An extract from last quarter loaded under this quarter's campaign is how a removed user reappears as a ghost, or a new admin never appears at all. The campaign refuses a source whose collected_at is older than the threshold for that source. The engineer sets the threshold. A directory can be a day old. A manual CSV someone drops in a bucket should be hours old, and the loader records who dropped it.
Close is a precondition, not a status click
A campaign that can be marked complete while items are pending will be marked complete. The engineer implements close as an operation that returns the blocking rows. Pending items block it. Revoke decisions with no API request id block it. Maintain decisions with an empty reason block it when the entitlement was supposed to carry a reason code. The closed timestamp is written only after that check. The evidence object uses that timestamp. A draft export is watermarked so it cannot be filed under the same name.
This is the difference between a product setting and a control you can defend. Many seats will show a completion percentage that treats silence as approval if you turn that setting on. The engineer leaves silence as pending and puts the overdue items on the campaign owner's morning list. Access review implementation is the same close rule applied across the sources you ingested. The person you hire is the one who will argue for that rule when a deadline makes "just close it" sound reasonable. The code is what makes the argument stick after they roll off.
Reviewer routing is part of close, because an item with no reviewer cannot be decided and therefore cannot close. The engineer maps entitlements to owners. A group with an owner in the directory uses that owner. An internal flag with no owner is assigned to the service owner named in the catalog, and if the catalog is empty the item sits in an unowned queue that is itself visible. An unowned queue that is hidden will still block close, and nobody will know why the button failed. The error lists the unowned entitlements. Filling the catalog is then a finite task.
The GRC platform receives the closed file. It already has a control statement that says access is reviewed quarterly. The engineer does not rewrite that statement. They make the file the statement points at match the population. A platform workflow that only includes the IdP will certify the IdP. The internal admin tool remains unaudited until its rows are in the same file or in a named sister campaign that also has to close.
Revoke is the API call and the recheck
A reviewer decision of revoke is a request, not a removal. The engineer writes the adapter: Graph remove member, Identity Center delete assignment, a SQL update for the internal flag, a GitHub API call to drop the team member. Each adapter stores the request id. The next ingest has to show the entitlement gone. The item moves to revoked only when the recheck agrees. A ticket in a help-desk queue is not the adapter, unless the ticket's resolution is read back and matched to the entitlement automatically. A ticket someone closes by hand, with the grant still in the database, will pass a campaign that does not recheck.
Partial failure is normal and has to be visible. Eight entitlements revoked, two failed because the token lacked a scope. The campaign stays open on the two. The evidence file for the period does not claim those two are gone. The engineer logs the API error on the item so the next person does not rerun the whole campaign to discover the scope. Security automation is where these adapters live next to the other removal jobs. Hiring a security automation engineer is the broader role. Access review is the slice with a quarterly deadline and a population you can count.
Privileged rows go first. The adapter order is admin and production, then ordinary membership. The campaign owner sees privileged failures on the first morning. Before the first live quarter, a sandbox subject is ingested, revoked, and rechecked, and that request id is kept.
What you should have at the end of the engagement
The handoff is source code, the schedule, the evidence bucket layout, and a short operator note. The note says how to add a source, how close fails, and how to read a revoke error. It does not say "contact the consultant to run the quarter." A company that hires the engineer and cannot run the next cycle has rented a person. The build includes the second-cycle dry run: the engineer watches your operator run ingest, open the campaign, and close a sandbox scope, and they fix the rough edges that show up. Then they leave the pipeline in your repository.
Scope control keeps the hire from becoming a new platform. The first sources are the ones in the audit sample: the IdP, the cloud permission sets, and the one internal tool the auditor already asked about. The sixth SaaS connector can wait. An engagement that starts by connecting everything will not close a campaign this quarter. Automating access reviews describes the steady state after those first sources run. The hire gets you to the first closed file that includes the ugly source.
Rutagon runs that diagnostic as a short pass over sources, open items, and revoke paths, and then does the build those three require. You keep the GRC platform and the IGA seat you already pay for. The entitlements outside that seat get a collector, a close rule, and an adapter.
Frequently Asked Questions
What should the job description emphasize?
Entitlement ingest from the systems in the audit population, a close operation that rejects pending items, and revoke adapters that store a request id and recheck the source. Campaign UX for a directory you already connected is what the seat you own is for. The engineer is for the source the seat cannot see and for the removal that has to actually happen.
How is this different from buying another IGA seat?
A seat brings a workflow and the connectors the vendor ships, which is the right buy for those systems. The engineer writes the collector for the internal tool, the close precondition, and the API call that removes the grant. Teams that already own a seat hire for that remainder, and the diagnostic shows which sources are still outside the seat.
Who should the engineer report to?
Usually the person who owns the access review control, with engineering review on the adapters. A contractor who reports only to compliance and cannot merge code will leave scripts on a laptop. A contractor who reports only to a platform team with no campaign deadline will build a framework and miss the quarter. The closed file is the shared outcome.
What does a finished engagement hand off?
Collectors on a schedule, the close check, revoke adapters with a sandbox fixture, evidence objects in the bucket, and an operator note that your team has used once without the engineer in the room. The second cycle's dry run is part of the engagement. A design document with no pipeline is not the handoff.
When is an engineer the wrong hire?
When the only population is a directory your current seat already reviews, close already rejects unfinished items, and revoke already rechecks. In that case the work is operation, not a build. The diagnostic is how you tell those apart before you open a requisition.
Ask for an access-review diagnostic of which sources are ingested, which campaigns can close with items still open, and which revoke decisions never reach an API. Contact Rutagon at rutagon.com/contact, 907-841-8407, or contact@rutagon.com.