Technical Security Analyst

VSG Business Solutions•Boston, MA

3d•Hybrid

About The Position

The Technical Security Analyst will serve as the hands-on security resource for a program replacing a heavily customized, on-premises HR and Payroll system supporting more than 95,000 employees with a SaaS cloud-based ERP solution. The role supports user access across multiple agencies and user types, from go-live readiness through ongoing operations. The position is based in Boston, Massachusetts, with a hybrid arrangement requiring at least four on-site days per month: the team is in the office on the second and fourth Tuesday of each month, plus two flexible days. The analyst must be able to report to Boston on short notice, including the same day; commuting costs are not reimbursed. After selection, screening includes a background check with CORI and state tax compliance, and three professional references are required at offer.

Requirements

Bachelor’s degree in computer science, systems analysis, or a related field, or equivalent experience in audit compliance and security risk and compliance management.
At least 5 years of IT implementation and operational experience, with knowledge of application development, audit compliance, database management, infrastructure and network design, security risk and compliance management, and cloud solutions.
Extensive experience providing operational security support to end users.
Experience with issue tracking systems such as JIRA.
Understanding of enterprise security practices, including IAM, RBAC, network security, SaaS and cloud security, data security, encryption, and file transfer management.
In-depth exposure to defining and implementing end-user security protocols in a large public or private organization.
Exposure to projects of similar size and complexity, and understanding of HR and Payroll systems security requirements.
Experience with frameworks such as ISO 2700x, ITIL, COBIT, and NIST, and in-depth knowledge of risk assessment methods.
More than 3 years developing, documenting, and maintaining security policies, processes, procedures, and standards.
Technical knowledge of mainstream operating systems and security technologies such as network security appliances, IAM systems, anti-malware, automated policy compliance, and desktop security tools.
Knowledge of network infrastructure, including routers, switches, firewalls, and related protocols.
Strong analytical, written, and verbal communication skills, and ability to work with people at all levels of an organization.

Nice To Haves

Operational security support in a SaaS solution and experience with SaaS implementations that migrated legacy on-premises applications.
Workday HR and Payroll, Workday Prism, and Workday user security management as part of a business (non-IT) team.
Experience transitioning traditional IT security functions to business teams.
Experience operating end-user security protocols in a large public or private organization.
Audit, compliance, or governance experience.
Experience with Microsoft security tools and Snowflake security.

Responsibilities

Implement security policies, processes, and standards for end-user roles, data access, and user provisioning and de-provisioning.
Partner with the program team, systems integrator, product vendor, and state IT to identify security requirements, including through risk and business impact assessments.
Provide operational security support to users as defined by SLAs, and facilitate communication between users and vendors through issue management software such as JIRA.
Perform security configuration updates and ensure security and access controls are implemented as planned throughout the user life cycle.
Support conversion of end users from the legacy system to the new system, including identifying and provisioning approved users for day-one go-live.
Advise security administrators on normal and exception-based authorization requests using vendor tools that monitor system use and data access irregularities.
Assist with resolving security incidents, liaise between incident response leads and subject matter experts, and monitor daily or weekly reports and security logs for unusual events.
Support the operational security playbook for day-two operations and ensure security operational documentation is complete.
Track changes in security standards, legislation, and regulations, and research new threats and alerts.
Support the new solution’s security profile, including Azure Active Directory entry, single sign-on integration between state IT and Workday, and user security and workflow roles.