Technical Security Analyst

Lancesoft; Boston (MA); Hybrid; USD 120.000 - 160.000; Vollzeit

Zusammenfassung

CTR in Boston seeks a BEST Technical Security Analyst to support end-user security for the new HR/payroll solution, coordinating with the BEST Deputy PM and EOTSS to deploy controls and standards. You will help define roles, access provisioning, and risk-based security configurations across agencies.

This hybrid, on-site role at CTR’s Boston office requires 37.5–40 hours per week and an 18–24 month duration, with collaboration across multiple teams to ensure secure Day One go-live.

Qualifikationen

• Extensive experience providing operational security support to end users.
• Experience with modern issue tracking systems (JIRA).
• Understanding of IAM, RBAC, Network Security, SaaS, Cloud Security, Data Security, Encryption, and File transfer management.
• Experience defining and implementing end user security protocols in large public/private entities.
• Exposure to security configurations in large projects of similar size.
• Knowledge of risk assessment methods and security frameworks (ISO, NIST, COBIT).
• Familiarity with WorkDay HR/payroll security requirements.
• Strong analytical and communication skills.

Aufgaben

• Identify security requirements with BEST Team, SI, and vendors; provide operational support per SLA.
• Implement Commonwealth IT policies on user and data security.
• Collaborate with Risk Management Office on assessments and controls.
• Develop security playbooks for day-2 operations and documentation.
• Advise on end-user security roles and provisioning workflows.

Kenntnisse

Operational security

JIRA

IAM RBAC

Workday security

Security policies

NIST ISO

SaaS security

Public sector

Cloud security

Incident response

Jobbeschreibung

Duration and Work Hours

Duration: 18-24 months

Hours Per Week: 37.5 - 40 Hr

Position: Hybrid

Location and On-Site Requirements

Employees are required to work a minimum of four business days per month on-site at CTR's Boston office. Must be in the office on the second and fourth Tuesday every month; the two additional in-office days are flexible and determined by the employee and their manager.

Position Summary

The BEST Technical Security Analyst will work for the BEST Deputy Program Manager and Solution Technical Lead to support the adoption of the future state end user security solution and protocols. Together with the PMO and Phase 2 Technical Lead, Phase 2 Risk and Compliance Lead, CTR Risk Management Team, Product Vendor, Systems Integrator (SI), Office of the Comptroller, and Executive Office of Technology Services and Security (EOTSS) staff to deploy technical controls to meet specific end-user security requirements, enable processes and standards to ensure that security configurations are maintained in the new Human Resource Management and Payroll solution. The BEST Technical Security Analyst will be a part of the BEST Technical Implementation team and work closely with the other members of the BEST team to develop and implement a comprehensive information security program.

This includes:

• Implementing security policies, processes and standards related to end user roles, data access for application users and how users will be provisioned and de-provisioned.
• Providing operational support for the BEST team, product vendors, and CMW users.
• The BEST Technical Security Analyst will work with the BEST Team, agencies, and SI and product vendors to identify the end-user roles and permissions that will be needed to implement the new Human Resource Management and Payroll solution in multiple agencies and across multiple user types in a manner that ensures appropriate access.
• Procedures for rolling out user security will be developed in conjunction with the SI and product vendors, office of the comptroller, EOTSS, and agency staff currently responsible for provisioning and de-provisioning users to the application.

Specific Duties

• Partner with the BEST Team, SI, and product vendors, CTR and EOTSS to identify security requirements, using methods that may include risk and business impact assessments. Components of this activity include but are not limited to: Provide operational support as defined by SLA requirements agreed to by the Commonwealth, the product vendor, and SI.
• Implementation of Commonwealth IT policies related to user security and data security.
• Work with the Commonwealth Risk Management Office in their assessments and recommended controls regarding data security and security operations.
• Conduct additional business system analysis as needed.
• Facilitate Communication between users and vendors using issue management software.
• Support development of the operational support playbook for day 2 operations.
• Ensure the completion of information security operational documentation.
• Works with BEST information security leadership to develop strategies, procedures and recommended roles and responsibilities to enforce security requirements and address identified risks related to the use of the new solution.
• Performs configuration updates and execution role in application development and implementation related to security requirements and controls, ensures that security controls are implemented as planned and that security and access needs are addressed throughout the User life cycle.
• Participates and supports the data conversion of end users from the legacy system to the new system.
• Works with BEST, CTR's, and EOTSS' CSOs, CIOs, and the Commonwealth's Risk Management Office to identify, select and implement technical controls related to data security and to implement security processes and procedures that ensure security controls are managed and maintained both centrally through the new solution, and within agencies if certain security management tasks are decentralized.
• Advises the BEST Team and SI and product vendors regarding end user security roles and groups, data access controls and security role provisioning and de-provisioning protocols to ensure that data are accessed appropriately in the new solution.
• Supports the BEST Team and Commonwealth agencies in identifying approved end users of the new solution and coordinating provisioning of users for Day One go live.
• Supports the definition and implementation of the security needs along with the BEST Security Workstream.
• Supports the BEST Maintenance and Operations Workstream.
• Advises security administrators on normal and exception-based processing of security authorization requests including the use of SI or product vendor provided tools that monitor system use and data access irregularities.
• Assists security administrators and IT staff in the resolution of reported security incidents.
• Acts as a liaison between incident response leads and subject matter experts.
• Monitor daily or weekly reports and security logs for unusual events.
• Maintain an awareness of existing and proposed security-standard-setting groups, state and federal legislation and regulations pertaining to information security.
• Identifies regulatory changes that will affect information security policy, standards, and procedures, and recommends appropriate changes.
• Research and assess new threats and security alerts and recommend remedial actions.
• Support the implementation of new solution complete security profile, including, but not limited to: Azure Active Directory (AD) entry Single Sign-on (SSO) integration between EOTSS and Workday New Solution User Security Role New Solution User Workflow Role

Required Skills

• Extensive experience providing operational security support to end users
• Experience working with modern issue tracking systems (JIRA)
• Understanding of enterprise security best practices, including but not limited to IAM, RBAC, Network Security, SaaS, Cloud Security, Data Security, Encryption, and File transfer management.
• In depth exposure to defining and implementing end user security protocols in a large public or private sector entity comparable in size to the Commonwealth.
• Exposure to technical configurations, technologies, and processing environments in one or more projects of similar size and complexity to BEST.
• Understanding of information risk concepts and principles as a means of relating business needs to security controls.
• Experience with common information security management frameworks, such as International Organization for Standardization (ISO) 2700x and the ITIL, COBIT and National Institute of Standards and Technology (NIST) frameworks.
• In-depth knowledge of risk assessment methods and technologies.
• Understanding of Human Resource and Payroll systems security requirements.
• Excellent technical knowledge of mainstream operating systems and a wide range of security technologies, such as network security appliances, identity, and access management (IAM) systems, anti-malware solutions, automated policy compliance tools, and desktop security tools.
• More than 3 years of experience in developing, documenting, and maintaining security policies, processes, procedures, and standards.
• Knowledge of network infrastructure, including routers, switches, firewalls, and the associated network protocols and concepts.
• Strong analytical skills to analyze security requirements and relate them to appropriate security controls.
• Ability to interact with personnel at all levels and across all business units and organizations, and to comprehend business imperatives.
• Excellent written and verbal communication skills.

Preferred Qualifications

• Experience with Software-as-a-Service cloud implementations particularly those in which legacy on premise applications have been migrated to cloud delivery options.
• Demonstrated operational security support experience in a Software as a Service (SaaS) solution.
• Experience with WorkDay Human Resource and Payroll solution.
• Experience with WorkDay Prism data and reporting solution.
• Experience with WorkDay user security management as a member of a business (non-IT) team.
• Experience in transitioning traditional IT security functions to business teams.
• Exposure to operating end user security protocols, policies, and other in a large public or private sector entity comparable in size to the Commonwealth.
• Audit, compliance, or governance experience is preferred.
• Experience with Audit, compliance, or governance actions.
• Experience with Microsoft security tools and functions
• Experience with Snowflake security functions