Principal Analyst, HR Technology Risk and Access Governance

Principal Analyst, HR Technology Risk and Access Governance

Onsite Location(s):
Arden Hills, MN, US, 55112

Additional Location(s): US-MA-Marlborough; US-MN-Arden Hills; US-MN-Maple Grove

Diversity
- Innovation
- Caring
- Global Collaboration
- Winning Spirit
- High Performance

At Boston Scientific, we’ll give you the opportunity to harness all that’s within you by working in teams of diverse and high‑performing employees, tackling some of the most important health industry challenges. With access to the latest tools, information and training, we’ll help you in advancing your skills and career. Here, you’ll be supported in progressing – whatever your ambitions.

At Boston Scientific, we are committed to protecting the integrity, confidentiality and operational reliability of our HR technology ecosystem while enabling efficient, scalable HR service delivery.

The Principal Analyst, HR Technology Risk and Access Governance will lead access governance, logical access controls, privileged access oversight, HRIS Sarbanes‑Oxley readiness and sensitive employee data protection across SAP Success Factors and other in‑scope HR platforms.

This role will translate control expectations, audit findings and privacy requirements into sustainable operating practices that reduce risk and strengthen HR systems governance. The Principal Analyst will partner with HR Operations, HR Technology, IT SOX, Cybersecurity, Identity and Access Management, Global Internal Audit, Privacy, Legal, Compliance and HR leadership to build effective access governance, role ownership, evidence and remediation processes across the employee lifecycle.

Boston Scientific was recently recognized as a Glassdoor Best Place to Work in 2026, ranking No. 15 on the Top 100 list, reflecting the culture our employees experience every day.

At Boston Scientific, we value collaboration and synergy. This role follows a hybrid work model requiring employees to be in our local office at least three days per week. Boston Scientific will not offer sponsorship or take over sponsorship of an employment visa for this position at this time. Relocation assistance is not available for this position at this time. This role may require up to 20% travel.

• Establish and maintain the HR technology risk and access governance operating model, including governance forums, decision rights, responsibility matrices, escalation paths and control ownership.
• Translate SOX requirements, privacy expectations, audit findings and enterprise security standards into clear HR processes with defined evidence, accountability and sustainability requirements.
• Maintain a multiquarter roadmap for preventive controls, access lifecycle management, role governance, privileged access oversight and ongoing monitoring.
• Partner with HR Operations, HR Technology, IT, Security, Identity and Access Management, Internal Audit, Risk, Compliance, Legal and Privacy to align governance requirements, resolve control gaps and support audit readiness.
• Serve as the HR subject matter expert for access governance, HRIS control design, sensitive data protection, risk remediation and control self‑assessments.
• Lead the design and continuous improvement of HR system access processes, including requests, approvals, provisioning, modifications, terminations, recertifications, exceptions and removals.
• Define and maintain access standards for HR employees, shared services, centers of excellence, HR business partners, managers, administrators, vendors, integrations, support roles, service accounts and privileged‑access users.
• Maintain role ownership models and role catalogs for critical HR system roles, including role purpose, approved user populations, sensitive permissions, owners, approval criteria and review frequency.
• Strengthen controls for administrative access, emergency access, integration accounts, proxy access, vendor support and other elevated‑or high‑risk access.
• Ensure HR system access is appropriately approved, justified, traceable, monitored, periodically reviewed, supported by evidence and removed when no longer required.
• Identify and remediate access risks, including…