Corporate System Security Administrator (15105, Grade 28)

Salary : $75,336.00 - $135,882.00 Annually
Location : Riverdale, MD
Job Type: Career
Job Number: 15105
Department: Office of CIO
Opening Date: 10/27/2026
Closing Date: 11/10/2026 11:59 PM Eastern

Description
Under direction, within the Office of the Chief Information Officer and the Enterprise Information Technology (EIT) program, leads and performs enterprise application security administration for the Commission's Workday ERP environment and related enterprise systems. The position is responsible for designing, configuring, administering, documenting, monitoring, and continuously improving security controls across Workday Human Capital Management, Payroll, Benefits, Finance, Procurement, Planning, Learning, reporting, integrations, and other implemented capabilities.

The incumbent develops and maintains Workday security groups, domain and business process security policies, role assignments, integration system security, service accounts, application programming interface access, and identity-related controls. The position applies least-privilege, role-based access, segregation-of-duties, privacy, audit, and risk-management principles; supports access certifications and control testing; and coordinates security incident response, remediation, and evidence collection.

The incumbent serves as a Workday security subject-matter expert within the EIT operating model and collaborates with functional owners, Information Security, Identity and Access Management, Internal Audit, Human Resources, Finance, Procurement, technical teams, implementation partners, and vendors. Work includes translating business requirements into secure access models, evaluating cross-functional impacts, supporting testing and production migrations, monitoring security changes and Workday releases, and maintaining a controlled, supportable, and auditable security environment.

Work may involve highly confidential or sensitive workforce, payroll, financial, procurement, and security information. Assignments are carried out independently within established policies, governance standards, change-control procedures, and accepted professional practices. The incumbent keeps management informed of status, risks, non-routine issues, and decisions requiring escalation. Work is evaluated for effectiveness, security, compliance, quality, timeliness, customer service, teamwork, documentation, and successful resolution of technical and business-control issues.

Examples of Important Duties

• Administers the Workday security framework, including security groups, domains, business process security policies, role assignments, user-based and role-based groups, segment-based or intersection security, and related tenant security configurations.
• Reviews, validates, provisions, modifies, and deprovisions access requests. Confirms authorization, business need, role alignment, least privilege, segregation of duties, and required approvals before implementing access.
• Administers and monitors privileged access, integration system users, service accounts, API access, and security supporting Workday integrations. Coordinates identity controls such as single sign-on, multifactor authentication, and identity lifecycle processes with appropriate technical teams.
• Performs periodic access reviews and certifications; monitors security group membership, domain access, business process permissions, elevated access, and inactive or transferred users; identifies and remediates inappropriate, excessive, conflicting, or obsolete access.
• Develops and maintains segregation-of-duties rules and compensating controls in coordination with functional owners, Finance, Human Resources, Procurement, Information Security, and Internal Audit.
• Creates and maintains security dashboards, audit reports, exception reports, control evidence, metrics, and documentation supporting operational monitoring, internal control assessments, external audits, privacy reviews, and regulatory or governance requirements.
• Investigates Workday security incidents, access anomalies, control failures, and suspected misuse. Performs root-cause analysis, coordinates containment and remediation, preserves relevant evidence, and recommends preventive improvements in accordance with incident response procedures.
• Maintains comprehensive security procedures and records, including request and approval documentation, provisioning and deprovisioning records, role design, security configuration decisions, test results, migration evidence, access-review results, exceptions, and remediation actions.

EIT Program, Governance, and Continuous Improvement

• Supports the EIT governance model by providing security analysis, recommendations, risk assessments, decision support, and status reporting for Workday and related enterprise initiatives.
• Participates in design reviews, architecture discussions, release planning, prioritization, testing, readiness, and post-production support. Escalates issues affecting security, compliance, scope, schedule, resources, or business operations through established governance channels.
• Coordinates with Workday, the implementation partner, managed-service providers, and other vendors to resolve security issues, validate remediations, obtain documentation, and maintain vendor accountability.
• Maintains current knowledge of Workday security features, semiannual releases, applicable Commission standards, cybersecurity practices, audit expectations, privacy requirements, and public-sector control frameworks. Assesses relevant changes and recommends adoption or remediation actions.
• Develops and delivers security guidance, procedures, knowledge articles, and role-based training for functional teams, support staff, approvers, and other authorized users. Provides technical direction and mentoring to less experienced staff.
• Promotes continuous improvement by analyzing service trends, recurring access issues, audit findings, security exceptions, and stakeholder feedback; recommends automation, standardization, and control enhancements that reduce risk and manual effort.
• Provides backup support for related enterprise application security and identity-access activities, as assigned. Performs other duties as assigned.

Important Worker Characteristics
A. Knowledge

• Expert knowledge of enterprise application security administration, identity and access management, role-based access control, least privilege, segregation of duties, privileged access, audit controls, privacy, and security risk management.
• Advanced knowledge of Workday security architecture, including security groups, domains, business process security, role assignments, integration security, service accounts, API access, tenant security, and security reporting.
• Knowledge of Workday HCM, Payroll, Benefits, Finance, Procurement, Planning, Learning, reporting, integrations, and related cross-functional business processes sufficient to assess access and control impacts.
• Knowledge of enterprise change management, release management, testing, migration, incident response, service management, documentation, and project governance practices.
• Knowledge of information technology disciplines such as application architecture, cloud services, integrations, databases, network concepts, identity services, logging, monitoring, quality assurance, and production operations.
• Knowledge of applicable Commission policies and procedures and relevant public-sector security, privacy, audit, records, and regulatory expectations. Knowledge of frameworks such as NIST Cybersecurity Framework is desirable.

B. Skills and Abilities

• Configure, analyze, test, document, and troubleshoot complex Workday security and access requirements across multiple functional areas.
• Interpret business requirements, policies, audit findings, and risk information and translate them into secure, practical, and supportable controls.
• Conduct access reviews, security assessments, control testing, root-cause analysis, and remediation; identify subtle risks and recommend proportionate corrective action.
• Use reporting and analytical tools to monitor access, identify anomalies, track metrics, prepare audit evidence, and communicate risk and compliance status.
• Lead or coordinate security workstreams, assign or review technical tasks, mentor staff, facilitate decisions, and work effectively across functional, technical, audit, vendor, and executive stakeholders.
• Communicate complex security and Workday concepts clearly in written and verbal form to technical and nontechnical audiences; obtain agreement, compliance, or timely action when required.
• Exercise discretion, sound judgment, confidentiality, customer service, and attention to detail while managing competing priorities and sensitive information.

Minimum Qualifications

1. Bachelor's Degree in Business Management, Computer Science, Information Systems or any related field.
2. Four (4) years of experience in Enterprise Resource Planning Systems or related experience.
3. An equivalent combination of education and experience may be substituted, which together total six (8) years.

Preferred Qualifications

• Direct experience configuring and administering Workday security for HCM, Payroll, Financials, Procurement, Benefits, integrations, or related modules.
• Workday Pro, Workday security training, or comparable Workday credentials.
• Experience supporting a large-scale Workday implementation and establishing post-production security governance and operational support.
• Experience with enterprise identity platforms, single sign-on, multifactor authentication, identity governance, service management, security information and event management, or access-review tools.
• Experience in government, public sector, or another regulated environment and familiarity with internal and external audit support.

Supplemental Information

Classification Specification: Corporate System Security Administrator

May be subject to medical, drug and alcohol testing.

Working Conditions: Works primarily in an office or approved remote-work setting. Work is predominantly sedentary and requires light physical effort. Work must be performed accurately and may require occasional overtime, after-hours, weekend, release-window, incident-response, or on-call support. The position may be subject to high work volume, tight deadlines, competing priorities, production incidents, audit requests, and handling of confidential or sensitive information.

2026 BENEFIT SUMMARY FOR MERIT SYSTEM EMPLOYEES

The following benefit summary is provided for informational purposes only and is not, nor should be construed as an employment agreement with the M-NCPPC, implied or actual. It is not all-inclusive and is subject to change. Benefits listed are extended to all Merit System employees of the Maryland-National Capital Park and Planning Commission (M-NCPPC). All plans are optional except the Defined Benefit and Long-Term Disability plans.

Eligibility
You have 45 days from your hire date to elect your benefits. Your coverage begins on the first of the month following receipt of your enrollment forms and required documentation.

Retirement Programs

• Defined Benefit Plan (Mandatory Participation) - Plan E excludes FOP members.

PlanEmployee ContributionPlan C9.5%* of base salary (FOP members only)Plan E4% of base salary up to maximum Social Security Wage Base (SSWB) and 8% in excess of SSWB.

• 457 (b) Plan (Optional) (Pre-tax and Roth)
• Traditional and Roth IRAs (Optional)
• Retiree Healthcare - Eligibility requires, at least 10 years of eligible service and continuous enrollment in M-NCPPC plans (or proof of continuous enrollment in comparable plans) during the 36 months immediately preceding your retirement date. Premium cost share based on years of service

Health Insurance Plans (FOP Members Pay 23% for Medical, Prescription and Dental and same as all other employees for Vision.) All other employees pay percentage below.*

• Medical
  • Kaiser Permanente Health Maintenance Organization (HMO) - (15%)
  • UnitedHealthcare Select Exclusive Provider Organization Health Plan (EPO) - (20%)
  • UnitedHealthcare Choice Plus Point of Service (POS) - (20%)
• Prescription - CVS Caremark - (15%)
• Dental - Delta Dental PPO and DeltaCare USA HMO - (20%)
• Vision - EyeMed - (80% of Low Option plan paid by Commission. Any balance paid by employee.)
  • Low, moderate, and high options are available. Frequency of covered services differs.

Flexible Spending Accounts (Employee Pays 100%)

• Medical Account - Maximum annual contribution: $3,300
• Dependent Care Account - Maximum annual contribution: $7,500

Long-Term Disability Insurance (Mandatory Participation)

• Employee Pays 20%: Commission Pays 80% (FOP Members Pay 100%)
• Benefits paid at 66 2/3% of base salary, maximum of $6,000/month

Supplemental Long-Term Disability Insurance (Employee Pays 100%)

• Benefits paid at 66 2/3% of base salary that exceeds $108,000; capped at $216,000

Basic Life and AD&D Insurance (Employee Pays 20%: Commission Pays 80%)

• Two (2) times base salary; maximum ben