A new hire opens the laptop on day one and the password she was sent last week works. Her mailbox is there, already on the right distribution lists. The finance app shows her team's cost centres and nothing else, and nobody had to raise a ticket for any of it. That quiet morning is the product of plumbing most staff never see, and building that plumbing is the job on offer here. Among remote sailpoint developer jobs, this opening is full-time, carries a $90,000 USD annual salary, and works from any country with a decent connection.
Stripped down, the SailPoint developer job description is code and configuration that decides who gets which accounts, when, and for how long. You build connectors, rules and workflows in IdentityIQ and Identity Security Cloud, onboard new applications, automate the joiner, mover and leaver processes, and dig into provisioning failures when they happen.
A joiner event usually starts as an HR record with a start date, department, manager and job code. SailPoint aggregates that record, correlates it to a new identity, and your birthright logic decides what that person should get on day one: a directory account, a mailbox, a VPN group, perhaps a role in the ticketing tool.
The hard part is timing and naming. Accounts created too early sit idle and invite misuse; late ones leave the new starter watching a spinner. Usernames collide, and two people called Ana Silva need different logins. Much of the joiner work is small, careful logic that handles those cases without a human stepping in.
Movers are where governance programmes quietly fail. Someone moves from accounts payable to procurement, gains new entitlements and keeps the old ones. A few moves later she can raise a purchase order and approve its payment, exactly what auditors look for.
Your job here is to detect the attribute change, work out which access belongs to the old role, and either remove it or send it to a manager for a decision. That means policy rules, separation-of-duties checks and sometimes a short grace period for handover.
When someone leaves, every account they hold should be disabled promptly, and in some systems deleted later on a schedule. A leaver workflow typically disables the directory account first, strips group memberships, converts the mailbox, and then works outward through the connected applications. If one target system is down, the workflow has to retry and report rather than fail silently. Urgent terminations need a faster path than the nightly batch.
Every application in the long tail has to be connected before SailPoint can govern it. Onboarding an application means reading its account and group schema, choosing a connector type, mapping attributes, setting up correlation so accounts link to the right identities, and testing create, modify, disable and delete operations.
Some applications have a supported connector and are mostly configuration. Others expose only a REST API, so you build web services operations with authentication, paging and error handling. Directories need solid LDAP knowledge: bind accounts, search bases, object classes and group membership attributes. Older systems may offer only a nightly flat file.
IdentityIQ is extended mainly through rules written in BeanShell, a scripting language that runs Java syntax inside the product, plus custom Java classes and plugins for heavier work. You will write build map rules, correlation rules, provisioning rules, before and after operation rules, and workflow steps that call them.
The tech stack this listing expects you to handle:
Good rule code is short, logs its decisions and never assumes an attribute is populated.
IdentityIQ is the long-established product, installed and run by the customer on its own servers or private cloud. You can customise almost anything in its object model, which is its strength and the reason upgrades take planning.
Identity Security Cloud is SailPoint's SaaS platform. The vendor runs the infrastructure; you work through configuration, transforms, a narrower set of cloud rules and APIs, with virtual appliances reaching on-premises systems. Many organisations run both during a migration, which is why this role asks for hands-on experience with either, plus a willingness to learn the other.
A manager reports that a new analyst still cannot open the reporting tool. Was the request approved? Did the plan compile? What did the target system send back? You trace the identity, read task results and provisioning transactions, then connector logs.
The cause is often dull: an expired service account password, a renamed group, a missing required attribute, or a rule that threw an exception. Finding it fast and writing down what happened is what earns trust from the help desk.
The core sailpoint developer skills here are three or more years of identity and access management development, strong Java and BeanShell, and hands-on IdentityIQ or Identity Security Cloud experience. LDAP and REST APIs are expected rather than optional. The SailPoint Certified IdentityIQ Engineer credential counts as a plus, not a gate.
The salary comes to $90,000 per year, in USD, for full-time work. Since location is open worldwide, that figure stays the same wherever you are based. Treat any general SailPoint developer salary you see quoted online as rough; this number is the one that applies here.
These three names come up together, but they lean in different directions. SailPoint is built around identity governance: lifecycle automation, access certifications, role modelling and policy. Saviynt also focuses on governance, delivered as a cloud platform, and is often weighed against SailPoint for the same projects. Okta is best known for access management: single sign-on, multi-factor authentication and the login experience, with governance features added over time.
In practice many companies run Okta at the front door and SailPoint or Saviynt behind it to decide who should hold which entitlements.
You cannot download SailPoint and run it at home, so most people learn on the job. A common route starts on a help desk or Active Directory team, moves into IAM operations, and then into development once you can write Java. Vendor training gives structure, and any SailPoint developer course worth paying for includes lab time on a live instance.
Security services firms with identity practices, Optiv being one well-known example, run SailPoint projects for many different clients. A stint in that kind of consultancy can compress years of exposure into a short period.
Searches for entry level remote sailpoint developer jobs mostly turn up operations or analyst roles, and that is a sensible first step. When you do apply for development work, a SailPoint developer resume should name the applications you onboarded and the rules you wrote. SailPoint developer interview questions often hand you a broken provisioning request and ask how you would trace it.
This listing is full-time, but identity work is also offered on contract. Contract roles typically ask for proof of similar implementations, a quick start, your own setup for invoicing, some overlap with the client's business hours, and acceptance of background checks and secure access rules.
Demand for this skill set has held up because every merger, cloud migration and audit finding creates more identities to govern, and machine identities and service accounts are adding to the pile. Migrations from IdentityIQ to Identity Security Cloud add more. People who can read a provisioning log and explain it to an auditor tend to stay employable.