IT Enterprise Applications Security Lead

BRG is seeking an experienced and strategic IT Enterprise Application Security Lead to oversee and enhance the security posture of our enterprise SaaS applications, with a strong emphasis on Workday. This role is responsible for defining and implementing application security strategies, policies, and best practices across multiple cloud-based platforms, ensuring compliance, data integrity, and secure operations in alignment with business and regulatory requirements.  Key Responsibilities: 

• Understand and document security models, controls, and options for all BRG Enterprise Apps, with a specific focus on Workday.
• Lead recurring internal security audits, specifically focused on changes made to our ERP system.
• Maintain strong knowledge of overarching BRG IT Security Policies, Standards, and Procedures.
• Create policies, standards or procedures specific to the operations of these apps that meet or enhance overarching BRG IT Security Policies.
• Partner with Workday administrators, HR, Finance, and IT stakeholders to ensure secure configuration, access controls, and role-based permissions.
• Determine framework for mapping compliance frameworks (NIST, ISO, SOC 2, SOC2, etc) to specific controls within the operations of enterprise applications.
• Documenting and ensuring enforcement of controls unique to the enterprise application suite.
• Organize and lead security remediation efforts identified by audits or other assessments.
• Lead responses to security questionnaires or provide input to questionnaires if the item is related to the security of our Enterprise applications. 
• Work with internal and external auditors to demonstrate and provide evidence for controls that are in place.
• Collaborate with identity and access management (IAM) teams to integrate with SSO/MFA and ensure secure user provisioning/deprovisioning.
• Respond to security incidents involving enterprise applications and participate in root cause analysis and incident reporting.
• Stay current with emerging security threats, trends, and best practices in SaaS and enterprise application security.
• Provide leadership and mentoring to junior security staff and cross-functional teams.
• Participate in Change Management.

Job Requirements:

• Bachelor’s degree in Computer Science, Information Security, related field, or equivalent work experience.  Advanced degree or relevant certifications (e.g., CISSP, CISM, GIAC) a plus.
• 5+ years of experience in major information technology functions.
• Strong familiarity with industry frameworks such as SOC2, ISO 27002, HIPAA, HITRUST.
• Familiarity with GDPR and CCPA.
• Experience with enterprise systems or ERP’s.  Workday a plus.
• Strong knowledge of application security principles, role-based access control (RBAC), segregation of duties (SoD), and data privacy.
• A self-starter with high levels of drive, energy, resilience, a can-do attitude, and willingness to take the initiative. Ability to operate independently.
• Ability to adjust to changing priorities.  Ability to effectively prioritize and execute tasks in a high-pressure environment.
• Excellent written and verbal communication skills. Must have a positive, professional attitude. Experience working with executive level clients.  Must be able to communicate complex topics to non-technical audiences. Excellent customer-facing/customer service skills. Excellent organizational skills.
• Position may require infrequent traveling for short periods. Trips will sometimes extend to 5 working days and could on rare occasions extend beyond 5 business days. All travel expenses will be reimbursed.  

Candidate must be able to submit verification of his/her legal right to work in the U.S., without company sponsorship.         Salary Range: $120,000-$170,000 #LI-AW1  #LI-REMOTE