Start a project
Menu
ServicesAll servicesCybersecurityCloud EngineeringApplication ServicesEnterprise PlatformsData & AnalyticsAI & Machine LearningInternet of ThingsMobilize Talent
PlatformsAll platformsIdentity and accessPrivileged access and secretsERP, HCM and financeCRM, ITSM and automationHealthcareInsurance and bankingData and integrationCloud and AIIndustrial, utilities and mainframeSkills matrix
Case studiesAll case studiesIdentity and accessPrivileged accessSecurity operationsCloud and infrastructureApplicationsERP and HCMCRM, ITSM and automationIndustry platformsData and analyticsAI and agents
IndustriesAll industriesEnergy, oil & gasHealthcare payersBanking & financial servicesInsurancePublic sectorManufacturingLocations
InsightsField notesLearning tracks
CompanyAbout CohashPortfolioSkills matrixCareersTrust and securityContact
Start a project
mobilize talent · staff augmentation

An extra engineer for the upgrade, without hiring for it.

The IdentityIQ upgrade window is fixed, and your team is already running day-to-day operations. We place contract engineers who join your standups, work in your tickets and follow your change process, with a Cohash practice lead behind them.

Talk to an engineerSee the architecture
platforms
mobilize-talent / staff-augmentation 9 platforms
01 · ROLE PROFILE 02 · ONBOARD 03 · YOUR TEAM 04 · COHASH SUPPORT Role profile: platforms · hours · duration Role profile platforms · hours ·duration Screened candidates: practitioner interview notes Screened candidates practitioner interviewnotes Contracts and checks: background checks per your policy Contracts and checks background checks peryour policy Access via your process: your IdP · your onboarding Access via yourprocess your IdP · youronboarding Contract engineer: your tickets · standups · changes Contract engineer your tickets ·standups · changes Your manager: priorities · daily direction Your manager priorities · dailydirection Cohash contact: scheduled check-ins Cohash contact scheduled check-ins Practice lead: identity · platform · data Practice lead identity · platform ·data Review point: extend · end · convert Review point extend · end · convert
SailPointSaviyntOktaCyberArk
in short·15-second read

At Cohash, staff augmentation means we place contract engineers on your team in identity, enterprise platform and data roles, and you direct them.

Priorities and day-to-day management are yours. Screening, contracting and ongoing support are ours, including a named Cohash contact and our practice leads when the engineer wants a second opinion. Engagements can be extended, ended with agreed notice, or turned into a permanent hire.

you probably need this if
  • An upgrade window is fixed and your team is already busy with daily operations.
  • You have a project plan but not enough engineers to carry it out.
  • A key engineer is on leave for months and their platform still needs care.
Ask an engineer facts checked 2026-10-20
how it runs
  1. 01Role profile
  2. 02Screen and introduce
  3. 03Onboard
  4. 04Support and review
you keep
  • Role profile and candidate interview notes
  • Onboarding checklist covering access and first-week goals
  • Check-in summaries at agreed intervals
+ 1 more documents
who does it
IAM engineer (SailPoint, Okta, CyberArk)Salesforce or Dynamics 365 developerSnowflake or Databricks data engineer
platforms
the story · staff augmentation

From the first call to a setup your own team can run.

Here's what usually prompts a call about your Staff Augmentation, what we do about it and in which order, and where you end up.

  1. chapter 01 · where it hurts

    Why teams reach out

    • An upgrade window is fixed and your team is already busy with daily operations.
    • You have a project plan but not enough engineers to carry it out.
    • A key engineer is on leave for months and their platform still needs care.
  2. chapter 02 · what we change

    How we solve it

    • Matched to the work
    • Works inside your team
    • Practice lead backing
    • Regular check-ins
    • Clear exit and handover
  3. chapter 03 · how it runs

    Our approach

    • Role profile
    • Screen and introduce
    • Onboard
    • Support and review
  4. chapter 04 · where you end up

    What changes

    • The migration has an engineer dedicated to it inside your change process while your team keeps operations running, and each migrated server comes with notes.
    • Fit problems surface at a scheduled check-in, and the remedy is already in the contract instead of being negotiated after the fact.
    • Benefit setup keeps moving while the lead is away.
    • Role profile and candidate interview notes
what we do

Where we spend the hours

5 areas of work, each one done by an engineer who has run it in production.

  1. Profile the role around your platforms, versions and environment. Screen the candidates with a practitioner interview before you meet any of them.

  2. Your managers direct the engineer, who works in your tools and tickets and goes through your change process. Set up their access through your own identity and onboarding process.

  3. If a contractor runs into something unfamiliar, like an odd Salesforce SSO edge case or a Unity Catalog permission question in Databricks, they can call a Cohash engineer who has seen it.

  4. A Cohash contact checks in with you and the engineer on a set schedule, so fit or scope problems come up early rather than at renewal.

  5. When an engagement ends, the engineer leaves documentation and runs a handover session. Remove their access through your offboarding process.

capability 01 / 05in production

Matched to the work

Profile the role around your platforms, versions and environment. Screen the candidates with a practitioner interview before you meet any of them.

talk to an engineer about this →
capability 02 / 05in production

Works inside your team

Your managers direct the engineer, who works in your tools and tickets and goes through your change process. Set up their access through your own identity and onboarding process.

talk to an engineer about this →
capability 03 / 05in production

Practice lead backing

If a contractor runs into something unfamiliar, like an odd Salesforce SSO edge case or a Unity Catalog permission question in Databricks, they can call a Cohash engineer who has seen it.

talk to an engineer about this →
capability 04 / 05in production

Regular check-ins

A Cohash contact checks in with you and the engineer on a set schedule, so fit or scope problems come up early rather than at renewal.

talk to an engineer about this →
capability 05 / 05in production

Clear exit and handover

When an engagement ends, the engineer leaves documentation and runs a handover session. Remove their access through your offboarding process.

talk to an engineer about this →
typical situations

Situations we walk into

We pieced these together from Staff Augmentation situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

A CyberArk connector migration that keeps slipping

composite · not a client story
  1. Beforethe situation

    A three-person PAM team runs CyberArk Privilege Cloud with on-premises connectors and handles failed password rotations every day. A planned connector server migration keeps slipping because the team never gets a clear week.

  2. What we dothe work

    Build the profile around the migration work and the CyberArk components involved. Test candidates with a scenario like a failed CPM rotation. Then agree a first-week plan, and request access through your normal onboarding.

  3. Afterwhere you end up

    The migration has an engineer dedicated to it inside your change process while your team keeps operations running, and each migrated server comes with notes.

case file 02

A contractor who is struggling in week three, and no written terms

composite · not a client story
  1. Beforethe situation

    An agency's contract Databricks engineer keeps getting stuck on Unity Catalog permissions and leans on the team daily. There's nothing in the contract about replacement, and the agency says give it time.

  2. What we dothe work

    Before the next engagement, write the replacement window, notice period and treatment of overlap time into the contract. Run a practitioner interview that includes a Unity Catalog grant scenario. Agree check-ins at fixed points in the first weeks.

  3. Afterwhere you end up

    Fit problems surface at a scheduled check-in, and the remedy is already in the contract instead of being negotiated after the fact.

case file 03

Months of leave for a Facets configuration lead during benefit setup

composite · not a client story
  1. Beforethe situation

    Benefit year setup is coming, and the Facets configuration lead will be on leave for several months of it. Everything they do is in tickets. None of it is in a runbook.

  2. What we dothe work

    Bring a contractor in a few weeks before the leave starts to pair on live tickets. Write the recurring configuration tasks into runbooks during pairing, and state in the contract that documentation produced belongs to you.

  3. Afterwhere you end up

    Benefit setup keeps moving while the lead is away. When they come back, there are runbooks waiting that weren't there before.

case studies

Staff Augmentation case studies

All case studies
upgrade Industry platforms

Nasdaq Calypso upgrade to V19

Upgrading Nasdaq Calypso to V19, with server consolidation, properties moved to the database, the WebUI and deployment changes tested on your own trades.

read the case study
migration Industry platforms

Duck Creek on-premises to Duck Creek OnDemand

We move self-hosted Duck Creek Policy, Billing and Claims onto Duck Creek OnDemand and keep the product and rating content, integrations and data intact.

read the case study
migration Industry platforms

Guidewire InsuranceSuite self-managed to Guidewire Cloud

Moving self-managed PolicyCenter, BillingCenter and ClaimCenter to Guidewire Cloud without carrying every Gosu customization and integration along.

read the case study
upgrade Cloud and infrastructure

Kubernetes, EKS and OpenShift version upgrades

Keeping EKS, AKS and OpenShift clusters on supported Kubernetes minors, and dealing with deprecated APIs, add-ons and node pools before each upgrade.

read the case study
upgrade Industry platforms

Murex MX.3 upgrades and the move to MXSaaS

Planning the next Murex MX.3 upgrade, or a move to MXSaaS, with automated regression on trades, valuations and accounting and the datamart reports traced.

read the case study
upgrade Industry platforms

Oracle Utilities CC&B 2.x to the 25.x release line

Taking Oracle Utilities CC&B from 2.6, 2.7, 2.8 or 2.9 to 25.4 on a tested upgrade path, with custom algorithms checked and bill cycles compared.

read the case study
architecture

How a contract engineer joins and works inside your team

From the role profile come practitioner-screened candidates, and you interview them and choose. The engineer gets onboarded through your own access process and works under your managers. A Cohash contact and a practice lead back them until you decide to extend, end or convert.

How a contract engineer joins and works inside your team From the role profile come practitioner-screened candidates, and you interview them and choose. The engineer gets onboarded through your own access process and works under your managers. A Cohash contact and a practice lead back them until you decide to extend, end or convert. 01 · ROLE PROFILE 02 · ONBOARD 03 · YOUR TEAM 04 · COHASH SUPPORT screen your choice access requests day one direction second opinion check-ins review offboarding Role profile platforms · hours ·duration Screened candidates practitioner interviewnotes Contracts and checks background checks per yourpolicy Access via your process your IdP · your onboarding Contract engineer your tickets · standups ·changes Your manager priorities · dailydirection Cohash contact scheduled check-ins Practice lead identity · platform · data Review point extend · end · convert
Read the diagram as text
  1. Role profile → Screened candidates: screen
  2. Screened candidates → Contracts and checks: your choice
  3. Contracts and checks → Access via your process: access requests
  4. Access via your process → Contract engineer: day one
  5. Your manager → Contract engineer: direction
  6. Contract engineer → Practice lead: second opinion
  7. Cohash contact → Contract engineer: check-ins
  8. Cohash contact → Review point: review
  9. Review point → Access via your process: offboarding
how it runs

A typical engagement

We don't start a step until the last one has produced something you can check.

  1. step 01

    Role profile

    Skills, platforms, seniority, working hours, location and how long you expect to need the role.

  2. step 02

    Screen and introduce

    Practitioner-screened candidates introduced with interview notes. You interview and choose.

  3. step 03

    Onboard

    Sign the contracts. Run background checks if your policy requires them. Raise access requests and agree a first-week plan with the hiring manager.

  4. step 04

    Support and review

    Scheduled check-ins, then an extend, end or convert decision at each review point.

you keep

What you're left with

We write these for your Staff Augmentation setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.

  • document01

    Role profile and candidate interview notes

    yours to keep
  • document02

    Onboarding checklist covering access and first-week goals

    yours to keep
  • document03

    Check-in summaries at agreed intervals

    yours to keep
  • document04

    Handover documentation at engagement end

    yours to keep
platforms

Tools we work in

SailPointIdentity governanceSaviyntIdentity governanceOktaAccess managementCyberArkPrivileged accessSalesforceCRMMicrosoft Dynamics 365CRM & ERPTriZetto FacetsHealthcare payerSnowflakeData platformDatabricksData platform
talent and delivery · staff augmentation

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
roles we staff
  • IAM engineer (SailPoint, Okta, CyberArk)
  • Salesforce or Dynamics 365 developer
  • Snowflake or Databricks data engineer
  • Facets configuration analyst
  • Cloud and DevOps engineer
  • QA automation engineer
due diligence · staff augmentation

Questions to ask any partner, including us.

Put these to anyone bidding on your Staff Augmentation work. The ones who've done it answer differently from the ones who've read about it.

  1. Q1

    If the engineer leaves or isn't a fit, what are the replacement terms? Are they in the contract?

    Ask for the replacement window, how quickly a new candidate is introduced and whether overlap time is billed. Verbal assurances don't help in week three.

  2. Q2

    Is the engineer on the provider's payroll, or subcontracted through some other firm?

    Layers of subcontracting affect background checks, IP assignment and who you can hold to the terms. Get the employment chain in writing.

  3. Q3

    Will the IP assignment cover the scripts, configuration and documentation too, or only code?

    A lot of what a platform engineer produces is configuration and runbooks. Make sure the contract assigns all of it to you, and that the engineer is bound by the same terms.

  4. Q4

    Which background checks will be run, by when, and who pays?

    Regulated environments often require checks a provider doesn't run by default. Agree the checks, timing and cost before the start date.

  5. Q5

    How is handover scoped when the engagement ends early?

    Notice periods can be short. Ask for handover deliverables and protected time written into the statement of work, so knowledge doesn't leave with the contractor.

01Who manages the contractor day to day?

You do. Your priorities, your tools. We look after the employment side and give technical backup, and we stay out of the way between you and the engineer day to day.

02What if the engineer isn't the right fit?

Talk to your Cohash contact. We'll hear both sides, and if it can't be sorted out we find a replacement. The terms for that, and the notice period, are in the contract from the start.

03How much does staff augmentation cost?

It depends on the skills and seniority, how long the engagement runs, and whether it's remote or on site. Once the profile's agreed, we quote that role.

04Should we use staff augmentation or a project team?

Staff augmentation fits when you have the plan and need hands. If you need someone to own the outcome, such as a full IGA rollout, a scoped project with Cohash delivery leadership is usually better. We'll say so if we think you're asking for the wrong one.

05Can contractors work on site or in our time zone?

That belongs in the role profile. Location, working hours and on-call needs affect who is available and the rate, so settle them before the search starts and write them into the contract.

related

Often paired with

Projects on Staff Augmentation usually end up touching one of these, so they're worth a look.

you are hereStaff Augmentation
sources 0 sources linked last checked 2026-10-20 content fingerprint 940efac5
  1. Vendor facts on this page link to their sources inline.
Reviewed by the Cohash team Product names are trademarks of their owners. how we handle facts and data →
next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies
useful to bring
  • The platform and the version you're on
  • Where you need to get to, and by when
  • What's custom: rules, plugins, integrations
  • Any audit finding or deadline driving it