Technology Operations & Security Coordinator

Technology Operations & Security Coordinator

Harvard Student Agencies | Part-time, hourly | Academic year (with possible summer extension)

HSA runs on a shared set of tools, including Google Workspace, Slack, Ramp, Shopify, and a Microsoft Azure environment that supports our Business Office. Nearly our entire workforce turns over every year. That combination creates predictable problems:

• Accounts outlive the people who use them.
• Ownership of shared logins and files gets messy.
• Credentials get passed along informally.
• Software and services are added or removed without first determining who else depends on them.
• Sensitive data ends up in places no one is tracking.

The Technology Operations & Security Coordinator will help HSA get its technology house in order and keep it that way. You will:

• Audit and clean up who has access to what.
• Map where our data lives and how it is protected.
• Make sure every software change is evaluated against the needs of the whole organization, not just one individual or team.
• Keep HSA in compliance with its payment card, insurance, recordkeeping, and data security obligations.
• Serve as the first point of contact for our permanent staff's technology needs.

Most importantly, you will document all of it, so that next year's team can run the system without you.

You will report to HSA's Chief Technology Officer. You will work closely with the General Manager, the Business Office, the Chief People Officer, and Patrick Carroll, HSA's marketing and technology agency partner.

Access and account lifecycle

• Audit users, roles, and permissions across Google Workspace, Slack, Ramp, Shopify, Azure, and the rest of the HSA technology stack. This includes domains, website and e-commerce platforms, payment accounts, and social media and advertising accounts.
• Flag dormant accounts, orphaned ownership, over-broad access, and unreviewed third-party app connections, and help remediate what you find.
• Partner with the Chief People Officer, who leads hiring, training, and departures, to build onboarding and offboarding checklists. Every new hire should get the right access on day one, and every departure should be closed out appropriately.
• Before any account is suspended or deleted, make sure its files, folders, and tool ownership are transferred to HSA. Closing an account should never cost HSA its records.
• Move business-critical files out of individual students' personal Google Drives and into Shared Drives owned by HSA.
• Establish clear ownership for shared accounts and admin seats, including how ownership transfers at each annual transition.
• Lead HSA's move to enforced multi-factor authentication, and to passkeys wherever they are supported.
• Define how credentials are created, stored, and shared. Move teams away from simple, weak passwords and informal practices such as texted/Slacked passwords and logins kept in shared documents.
• Create a simple, repeatable process for requesting, approving, granting, and revoking access, including a periodic access review.

Data protection and retention

• Build and maintain an inventory of HSA's sensitive data. This covers customer, client, employee, and payment information: where it lives, who can access it, and how long we keep it.
• Identify and reduce data exposure, including files shared publicly, shared with personal accounts, or stored outside HSA systems.
• Work with the Business Office and the Chief People Officer to develop data handling and retention policies. These include rules for personal devices and accounts, as well as retention schedules that meet IRS, government reporting, and other recordkeeping requirements.
• Help incorporate these policies into the employee handbook and the annual employee sign-off completed through Paycom.
• Help maintain HSA's written information security program, as required by Massachusetts data security regulations (201 CMR 17.00).
• Help maintain a simple incident response plan covering who to contact and what to do if an account is compromised, a device is lost, or data is exposed.
• Develop a brief security orientation for the incoming team each fall, covering phishing, password manager use, data handling, and how to report a problem.

Software governance and spend

• Maintain an inventory of every software tool, add-on (including Shopify apps), and integration HSA uses. For each, record its owner, purpose, the teams and records that depend on it, seat count, cost, renewal date, and any other relevant metadata.
• Establish and maintain a software change process,…