Technical Security Analyst

Location: Boston, MA, hybrid. A minimum of four on-site days per month (the team is in the office the second and fourth Tuesday of each month, plus two flexible days), remote the rest. You must be able to report to Boston on short notice, including the same day. Commuting costs are not reimbursed.

Screening: Background check including CORI and state tax compliance after selection, and three professional references at offer.

Job Overview:

The Client is replacing its heavily customized, on-premises HR and Payroll system, which supports more than 95,000 employees, with a SaaS cloud-based ERP solution. As Technical Security Analyst, you would be the hands-on security resource for the program: setting up and supporting user access across many agencies and user types, from go-live readiness through day-to-day operations.

What you'll do

• Implement security policies, processes and standards for end-user roles, data access, and user provisioning and de-provisioning.
• Partner with the program team, systems integrator, product vendor and state IT to identify security requirements, including through risk and business impact assessments.
• Provide operational security support to users as defined by the SLAs, and facilitate communication between users and vendors through issue management software (JIRA).
• Perform security configuration updates and make sure security and access controls are implemented as planned throughout the user life cycle.
• Support the conversion of end users from the legacy system to the new system, and the identification and provisioning of approved users for day-one go-live.
• Advise security administrators on normal and exception-based authorization requests, using vendor tools that monitor system use and data access irregularities.
• Assist with resolving security incidents, act as a liaison between incident response leads and subject matter experts, and monitor daily or weekly reports and security logs for unusual events.
• Support the operational security playbook for day-two operations, and make sure security operational documentation is complete.
• Track changes in security standards, legislation and regulations, and research new threats and alerts.
• Support the new solution's security profile, including Azure Active Directory entry, single sign-on integration between state IT and Workday, and user security and workflow roles.

Minimum requirements

• Bachelor's degree in computer science, systems analysis or a related field, or equivalent experience in audit compliance and security risk and compliance management
• 5+ years of IT implementation and operational experience, with knowledge of application development, audit compliance, database management, infrastructure and network design, security risk and compliance management, and cloud solutions

Required skills

• Extensive experience providing operational security support to end users
• Experience with issue tracking systems such as JIRA
• Understanding of enterprise security practices: IAM, RBAC, network security, SaaS and cloud security, data security, encryption and file transfer management
• In-depth exposure to defining and implementing end-user security protocols in a large public or private organization
• Exposure to projects of similar size and complexity, and an understanding of HR and Payroll systems security requirements
• Experience with frameworks such as ISO 2700x, ITIL, COBIT and NIST, and in-depth knowledge of risk assessment methods
• More than 3 years developing, documenting and maintaining security policies, processes, procedures and standards
• Technical knowledge of mainstream operating systems and security technologies such as network security appliances, IAM systems, anti-malware, automated policy compliance and desktop security tools
• Knowledge of network infrastructure, including routers, switches, firewalls and related protocols
• Strong analytical, written and verbal communication skills, and the ability to work with people at all levels of an organization

Preferred qualifications

• Operational security support in a SaaS solution, and SaaS implementations that migrated legacy on-premises applications
• Workday HR and Payroll, Workday Prism, and Workday user security management as part of a business (non-IT) team
• Transitioning traditional IT security functions to business teams
• Operating end-user security protocols in a large public or private organization
• Audit, compliance or governance experience
• Microsoft security tools and Snowflake security