Training on your platforms, using your own configuration.
Generic courses teach the product. Your team needs to know why your IdentityIQ rules are written the way they are, and what breaks when the next version ships. We build training around your environment and run it with the engineers who will maintain it.
Training plantopics · format · scheduleYour upgrade roadmapvendor release dates
03 · Teach and practice
Labs on your configurationSailPoint rules · Snowflake rolesPairing and shadowingreal tickets · gradual handoverCertification prepstudy plans · practice
04 · Review
Follow-up assessmentcovered · still openRunbooks and recordingskept by your team
SailPointOktaMicrosoft Entra IDSalesforce
in short·15-second read
Talent development at Cohash is hands-on training for your existing engineers on identity, enterprise platform and data systems.
We assess current skills, build a plan around the platforms and upgrades on your roadmap, and teach with your own configurations in a non-production environment. Sessions are led by Cohash engineers who work on those platforms, and the material stays with your team afterward.
you probably need this if
A major upgrade is coming up on the roadmap and nobody on your team has run one on this platform before.
Vendor courses taught the product but not your custom rules and integrations.
One engineer holds most of the platform knowledge and you want it shared.
Identity platform trainerSalesforce and Dynamics 365 trainerData platform trainer
platforms
the story · talent development
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Talent Development, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · talent development3 open
openA major upgrade is coming up on the roadmap and nobody on your team has run one on this platform before.
recurringVendor courses taught the product but not your custom rules and integrations.
blockedOne engineer holds most of the platform knowledge and you want it shared.
exposure
Skills assessmentEnvironment-based labsUpgrade readinessPairing and shadowingCertification preparationKnowledge capture
startrehearsehandover
Assess
Plan
Teach and practice
Review
we are here
ready to hand over
The team goes into the upgrade having already done each step on its own configuration…
Engineers can explain why a user has access and change grants with confidence, and the…
Skills assessment per engineer
Training plan tied to your platforms and roadmap
chapter 01 · where it hurts
Why teams reach out
A major upgrade is coming up on the roadmap and nobody on your team has run one on this platform before.
Vendor courses taught the product but not your custom rules and integrations.
One engineer holds most of the platform knowledge and you want it shared.
chapter 02 · what we change
How we solve it
Skills assessment
Environment-based labs
Upgrade readiness
Pairing and shadowing
Certification preparation
Knowledge capture
chapter 03 · how it runs
Our approach
Assess
Plan
Teach and practice
Review
chapter 04 · where you end up
What changes
The team goes into the upgrade having already done each step on its own configuration, and the rehearsal notes become the runbook.
Engineers can explain why a user has access and change grants with confidence, and the runbook is theirs.
Skills assessment per engineer
Training plan tied to your platforms and roadmap
what we do
Where we spend the hours
6 areas of work, each one done by an engineer who has run it in production.
Short technical conversations and hands-on exercises show where each engineer is strong and where the gaps are. We share what we find with the engineer and their manager.
Exercises built on a copy of your configuration, such as your SailPoint rules, Salesforce permission sets or Snowflake roles, so lessons transfer to Monday's work.
Training timed to the vendor releases on your roadmap. Your team learns what changes before the upgrade, not during the outage window.
A Cohash engineer works alongside your staff on real tickets or a project, then hands the lead over gradually.
Study plans and practice for vendor certifications your team is pursuing, aimed at the work as well as the exam.
We write runbooks and diagrams and record walkthroughs as the training goes, so the knowledge doesn't walk out the door with one person.
capability 01 / 06in production
Skills assessment
Short technical conversations and hands-on exercises show where each engineer is strong and where the gaps are. We share what we find with the engineer and their manager.
Exercises built on a copy of your configuration, such as your SailPoint rules, Salesforce permission sets or Snowflake roles, so lessons transfer to Monday's work.
We pieced these together from Talent Development situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
An IdentityIQ team that has only ever applied patches
composite · not a client story
Beforethe situation
A team maintains IdentityIQ 8.x with dozens of custom rules and plugins. The 9.0 move to Jakarta EE is on next year's roadmap, and nobody on the team has run a major version upgrade.
What we dothe work
Assess each engineer on rule writing, plugin builds and deployment. Build labs on a copy of your configuration where they find javax imports, rewrite a rule for Jakarta and run a rehearsal upgrade in a sandbox, then pair on the real upgrade plan.
Afterwhere you end up
The team goes into the upgrade having already done each step on its own configuration, and the rehearsal notes become the runbook.
case file 02
A Snowflake role hierarchy nobody dares to change
composite · not a client story
Beforethe situation
A data team inherited a Snowflake account with a deep role hierarchy built by an architect who has left. Engineers avoid changing grants because they can't predict what will break, so access requests wait for weeks.
What we dothe work
Diagram the current hierarchy from SHOW GRANTS output, then run workshops where engineers trace access paths and make changes in a separate test account. Have the team write its own short runbook for adding a role or grant.
Afterwhere you end up
Engineers can explain why a user has access and change grants with confidence, and the runbook is theirs.
How a training program moves from assessment to handover
We assess each engineer and the systems they own, then plan training around your roadmap. Labs run on a copy of your configuration in non-production. Pairing happens on real tickets. A follow-up assessment closes the program.
01 · Assess
Skills conversationsper engineer · practical exercises → Training plan · gaps
System reviewconfig · custom code · history → Training plan · what to cover
02 · Plan
Training plantopics · format · schedule → Labs on your configuration · workshops→ Pairing and shadowing · assignments→ Certification prep · optional track
Your upgrade roadmapvendor release dates → Training plan · timing
03 · Teach and practice
Labs on your configurationSailPoint rules · Snowflake roles → Runbooks and recordings · written up→ Follow-up assessment · progress
Training plan → Labs on your configuration: workshops
Training plan → Pairing and shadowing: assignments
Training plan → Certification prep: optional track
Labs on your configuration → Runbooks and recordings: written up
Pairing and shadowing → Follow-up assessment: progress
Labs on your configuration → Follow-up assessment: progress
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Assess
One skills conversation per engineer, plus a review of the systems each of them is responsible for.
step 02
Plan
A training plan agreed with the team lead, covering topics, format, schedule and how progress will be checked.
step 03
Teach and practice
Workshops, labs and pairing happen in your environment. We schedule them around operations work.
step 04
Review
A follow-up assessment and a written summary of what's covered and what's left.
you keep
What you're left with
We write these for your Talent Development setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
Identity platform trainer
Salesforce and Dynamics 365 trainer
Data platform trainer
Mentor engineer for new hires
Runbook and knowledge transfer lead
due diligence · talent development
Questions to ask any partner, including us.
Put these to anyone bidding on your Talent Development work. The ones who've done it answer differently from the ones who've read about it.
Q1
Will labs use our real configuration, and who approves copying it into a lab?
Labs on your own rules and permissions transfer best. Copying configuration needs a security sign-off, though, so write the data handling and the lab environment into the plan.
Q2
Who owns the training materials and recordings afterward?
Runbooks, labs and videos built on your systems should be yours. Get it in writing that you can reuse and change them after the trainer has gone.
Q3
How will you measure whether the team can now do the work?
Showing up to sessions doesn't prove anyone learned anything. Ask for an assessment before and after, tied to work the team has to do, such as a rehearsal upgrade.
Q4
Which instructors will teach, and what do they work on day to day?
A trainer who reads slides can't explain why your rule fails. Ask about the instructors' platform work, and meet them before the plan is signed.
Q5
How will sessions fit around operations and on-call?
Sessions that clash with an incident get dropped. Agree the schedule with the team lead, then protect it.
01Is this a replacement for vendor training?
No. Vendor courses cover the product well. We cover your implementation of it, including custom code, integrations and the history behind your design choices. Many teams use both.
02How long does a training program run?
It depends on the number of engineers, how many platforms are in scope and how much time they can spend away from operations. Some teams want a focused week before an upgrade, others want a few hours a week over a quarter.
03Do you train non-engineers?
Sometimes. We run sessions for access reviewers, platform admins and business owners when it supports the engineering work, such as teaching managers what they're approving in a certification campaign.
04Can you train our team on a system you didn't build?
Yes. We start by reviewing the configuration ourselves, then build the training around what we find.
05Can sessions be recorded for engineers who join later?
Yes, as long as your security team is comfortable with recordings that show your configuration. New starters get a lot from recordings and lab guides, but doing the work by hand still teaches more than watching.
related
Often paired with
Projects on Talent Development usually end up touching one of these, so they're worth a look.
