Job Description & Details
This is a heavy-duty Workday security role where you'll spend your days playing gatekeeper to critical HR, payroll, and financial data. If you enjoy untangling complex permission structures and making sure the right people have access to the right data without breaking compliance, this position gives you the autonomy to lock down the ecosystem right.
What You'll Actually Be Doing
You'll spend a good chunk of your time architecting and maintaining security groups like Role-Based, User-Based, and Intersection across Core HCM, Benefits, and Payroll. Day-to-day work involves tweaking Domain Security Policies and Business Process Security Policies while juggling audit prep, running User Access Reviews, and handling Segregation of Duties checks. You'll also configure ISUs and ISSGs for integration touchpoints, and safely push config changes across tenants using Object Transporter when bi-annual updates drop.
The Core Tech Stack
You need absolute fluency in Workday Security Architecture and a deep understanding of least-privilege access models. Knowing your way around Domain Security Policies (DSP), Business Process Security Policies (BPSP), and integration security accounts (ISU/ISSG) is non-negotiable. Plus, you should be comfortable leveraging Workday Custom Reports and Calculated Fields to pull data for security audits and compliance frameworks like SOX and GDPR.
Interview Expectations
Expect the hiring team to present a tricky scenario where a cross-functional integration breaks because an ISU lacks specific domain access, and they'll want to hear your step-by-step troubleshooting logic to fix it without blowing up the security matrix. They are secretly testing whether you understand the ripple effects of changing a Business Process Security Policy in a live tenant, so walk them through how you test impacts in sandbox environments first.
Application Advice
Skip the generic phrasing and put your Workday Security Certification front and center if you have it. Make sure your resume explicitly calls out your hands-on experience with Object Transporter, audit frameworks like SOX or GDPR, and specific security group types so you easily sail past the initial ATS keyword filters.