IGA consulting, in the mid-market, should not start with a year-long platform bake-off. You have an HRIS, an IdP, thirty SaaS apps, and a handful of internal tools the IGA suite will not speak to on day one. What you need is joiner-mover-leaver that reaches those tools, recertification that produces a revoke list, and evidence a Type 2 sample can use. That is an engineering engagement. It is not a mega-implementation.
Rutagon is the boutique that builds that layer. We are not selling an IGA product and we are not pitching a cheaper enterprise suite. If you already bought a suite, we still show up as the connector and evidence work the integrator scoped out. If you did not, we often never need the suite.
What Mid-Market IGA Actually Is
Headcount 50–500, SOC 2 on the calendar, maybe ISO next. Identity already lives in Okta or Entra. HR already lives in Workday, BambooHR, Rippling, or UKG. The gap is:
- Hire / transfer / terminate stop at the IdP (joiner mover leaver automation)
- Custom apps have local users (automate access reviews)
- Quarterly reviews rubber-stamp (privilege creep detection)
- Salesforce is certified as licenses, not effective access
- Contractors are not in the HRIS feed
Enterprise IGA programs solve a different problem: thousands of birthright roles, mainframe connectors, a program office, a multi-year roadmap. Forcing that shape onto a 180-person SaaS company is how you spend a year on workshops and still disable the support console by hand.
NIST SP 800-53 AC-2 still expects account lifecycle management whether or not you bought a suite. The consulting question is who builds the last mile.
What an IGA Consulting Engagement Looks Like Here
We scope from systems, not from a platform RFP.
Week 1–2 — Diagnostic. System list, IdP apps, HRIS events, last audit findings, who owns each admin tool. Output: ranked gaps, not a 60-page strategy deck. Same motion as an Access & Credential Governance Diagnostic.
Week 3–N — Build. Event consumer for join/move/leave. Connectors for the non-SCIM apps in the sample. Review packet that includes usage-vs-grant. Offboarding sequence for employees (revoke, mailbox, seats). Evidence jobs the GRC locker can attach.
Handoff. Runbooks, Terraform or repo ownership, and a named internal owner. We do not quietly retain your identity plane unless you ask for a follow-on.
This is the same split as vCISO vs boutique engineering: the vCISO owns risk language and the audit relationship. We own the code that makes the control true. Many clients have both. Some have neither and still hire the build because the finding is already written.
What We Will Not Do as "IGA Consulting"
- Run a six-vendor IGA bake-off so you can pick a platform you will not finish implementing
- Staff a program team to write role catalogs for jobs you do not have
- Replace Okta or Entra with a new source of truth
- Promise a SOC 2 report or an ISO certificate
- Quote "cheaper than the enterprise suite" as the value — the value is finishing the last mile
If a platform is already purchased and stalled, we will say so. Sometimes the right move is finish three connectors and the review export. Sometimes the right move is stop the platform project and build the event path. We pick with you. We do not upsell a rip-and-replace for its own sake.
Hire FTE, Staff Aug, or This Engagement
| Path | When it fits | When it does not |
|---|---|---|
| FTE identity engineer | Ongoing IGA product, years of backlog | You need the next audit window, not a hiring cycle |
| Staff aug on the platform vendor | You are committed to that product's model | Your gaps are custom apps the product does not reach |
| Boutique build (us) | Fixed systems, fixed window, ship connectors + evidence | You want a retained CISO or a product license |
Identity engineering is specialized. Handing it to a generalist backend squad as a side quest is how mover events never ship. Hiring a full-time IGA engineer for a 90-day close is how you invent a role you cannot fill.
Pricing Shape, Not a Number
We work fixed-scope or capped-hours against a named system list and a named audit window. We do not publish rates here. We do not use another vendor's list price as a foil. The diagnostic is the start: rutagon.com/contact.
Deliverables you should walk away with, whatever the commercial wrapper:
- Job-code / birthright map
- Working JML path into the apps the auditor already sampled
- Review campaign that can revoke, not only approve
- Evidence objects with owners and dates
- A written leftover: what we did not automate and why
How This Relates to Security Automation
IGA consulting is the hire page for the work described under security automation. The capabilities page is what we build. This page is when you should call a firm instead of opening a req or restarting a platform SOW.
If the only pain is AWS keys in CI, you may want a credential-elimination pilot, not an IGA label. If the only pain is a GRC locker full of stale screenshots, you want evidence jobs. Use the name that matches the backlog. We will not stretch "IGA" over a CloudTrail ticket.
Book a technical call: rutagon.com/contact · 907-841-8407 · contact@rutagon.com.
Frequently Asked Questions
Do we need to buy an IGA product before engaging you?
No. Many mid-market teams never need one if HRIS, IdP, and a connector layer cover the sample. If you already bought a product, we work behind it.
How is IGA consulting different from a vCISO retainer?
A vCISO advises and owns the audit conversation. IGA consulting here is implementation: events, connectors, review packets, evidence jobs. Some companies retain both.
Will you implement SailPoint, Saviynt, or similar?
We will integrate or finish last-mile work if that is already the chosen system. We will not open an engagement whose first three months are a suite implementation program. That is a different class of partner.
What do you need to scope the work?
Last findings letter or readiness list, IdP admin access (read), HRIS event shape, and the list of apps the auditor sampled. A diagnostic week is usually enough to price the build.
How long before this shows up in an audit packet?
Focused connector and review-export work is scoped in weeks, not a multi-year program. Exact duration depends on how many non-SCIM systems are in the sample — we will not guess that before the system list exists.