Program Security Architect

JOB TITLE: Program Security Architect JOB LOCATION: Boston, MA WAGE RANGE*: $100-$107 JOB NUMBER: ITS87 RFR-FY27-004 - BEST Program Security Architect JOB DESCRIPTION: The BEST Program Security Architect will work for the BEST Solution Technical Lead and Deputy Program Manager to support the adoption of the future state end user security solution and protocols. Deploying technical controls to meet specific end-user security requirements, enable processes and standards to ensure that security configurations are maintained in the new Human Resource Management and Payroll solution. As a key member of the project's Security Team, the Risk and Compliance Lead will work closely with other team members to develop and implement a comprehensive information security program. This includes: • Design and recommend protocols and procedures for monitoring the product vendor's performance against Service Level Agreement standards regarding data security, annual security audits, and disaster recovery testing. • Collect documentation and other artifacts as the project develops to support comprehensive IT and other statewide audits, which will require documentation of conversion between systems, validation of data, operations and other content and support data reliability. • Propose security policies, processes and standards related to end- user roles, data access for application users, and how users will be provisioned and de-provisioned. • Provide input on selection, deployment, and oversight of security technologies and other compliance and risk management/mitigation strategies. Support of coordinated operational change management strategy to ensure a successful implementation of training materials, training resources and training opportunities to support compliance with HR Payroll policies and guidance and successful system change management for users. The Software as a Solution (SaaS) model chosen by the Commonwealth includes data security protocols and procedures that are audited annually by a third party. Specific Duties This position will oversee implementation of the three major security components: • Infrastructure (hosting) security • Application Security • User Authentication security Align with BEST project team, vendor, SI, EOTSS security, and Comptroller Risk Management Team, including but not limited to: o Partner with EOTSS to onboard Workday and Workday Prism to work with the Commonwealth Single Sign On - SSO for employees and for vendors, as appropriate. o Oversee security SLAs with the vendor(s) to ensure appropriate security reports are created. o Provide recommendations regarding end user security roles and groups, data access controls and security role provisioning (onboarding) and de-provisioning (offboarding) protocols to ensure that data are accessed appropriately in the new solution in cooperation with the Comptroller Risk Management Team. o Oversee and advise BEST program use of AI tools from a security point of view. o Advise Vendor and SI on use of AI tools that are built into the Workday product natively. o Ensure the completion of information security operations documentation. o Develop strategies, procedures and recommended roles and responsibilities to enforce security requirements and address identified risks related to the use of the new solution. o Oversee configuration updates and execution role in application development and implementation related to security requirements and controls, ensures that security controls are implemented as planned and that security and access needs are addressed throughout the User life cycle in collaboration with the Comptroller Risk Management Team. o Provide advise and recommendations to the data conversion of end users from the legacy system to the new system. o Work with BEST, CTR's, and EOTSS' CSOs, CIOs, and the Comptroller's Risk Management Office to identify, select and implement technical controls related to data security and to implement security processes and procedures that ensure security controls are managed and maintained both centrally and within agencies for certain security management tasks are decentralized. o Advise the BEST Team and SI and product vendors regarding end user security roles and groups, data access controls and security role provisioning and de-provisioning protocols to ensure that data are accessed appropriately in the new solution. o Supports the BEST Team and agencies in the tasks required to identify approved end users of the new solution and coordinate provisioning of users for Day One go live. Equal opportunity employer as to all protected groups, including protected veterans and individuals with disabilities * While an hourly range is posted for this position, an eventual hourly rate is determined by a comprehensive salary analysis which considers multiple factors including but not limited to: job-related knowledge, skills and qualifications, education and experience as compared to others in the organization doing substantially similar work, if applicable, and market and business considerations. Benefits offered include medical, dental and vision benefits; dependent care flexible spending account; 401(k) plan; voluntary life/short term disability/whole life/term life/accident and critical illness coverage; employee assistance program; sick leave in accordance with regulation. Benefits may be subject to generally applicable eligibility, waiting period, contribution, and other requirements and conditions. Benefits offered are in accordance with applicable federal, state, and local laws and subject to change at TCM's discretion.