Sapna Shah

About Sapna Shah

I\'ve been in the Workday ecosystem since 2018, working across nearly every corner of the platform — Core HCM, Benefits, Recruiting, Compensation, Time & Absence, Talent & Performance, Payroll, Integrations, Reporting, and Security. That breadth is what makes me effective in a security-specialized role — I understand how the business uses the system, and I design protection around that reality.Today I serve as the Workday Security Lead and SME at Blue Origin, protecting sensitive data for workers across 9 tenants. I build what doesn\'t exist yet — data governance frameworks, scalable security architectures, and audit-ready compliance models. At Blue Origin that\'s included cutting sensitive data exposure by 59%, architecting an 18-month security revamp across ~558 undocumented security groups, and executing a phased sensitive data restriction initiative across ~300 users. I also leverage AI tools — Claude Code and GPT — to build playbooks, test cases, and user guides at scale.Prior to Blue Origin, I\'ve consulted and delivered across Accenture, VMware, CFA Institute, and others — bringing the same combination of functional depth, cross-functional collaboration, and a bias toward building things that last.Agile practitioner. If you\'re building or maturing a Workday practice — let\'s connect.

Experience

1. Workday Security Lead

   Blue Origin

   Jan 2025 — Present · Laurel, MD, US

   Workday Security SME at Blue Origin - protecting sensitive data for workers (employees + contingent workforce) across 9 tenants, building the security architecture, governance, and controls that did not exist before this role. Operating within an Agile framework to manage security initiatives through iterative sprints, backlog prioritization, and cross-functional standups. Enterprise Security Revamp: Architecting a full overhaul of ~558 security groups (458 employee-facing +~100 integration system groups)- targeting reduction to 250-300 user groups, with named ownership, SoD controls, executive data restrictions, HR4HR data privacy controls, and a live governance model at close. Sensitive Data Restriction: Executing a phased plan to restrict access to compensation demographics, and performance data across ~300 users - manager-validated, function-by-function, with rollback plans at every step.Data Governance: Building Blue Origin\'s first Workday data governance framework from scratch - approval workflows, access policies, and population-level controls for workers.Audit Monitoring: Drafted business case for Workday-Splunk integration to detect unauthorized access; evaluating Kainos Smart Audit for scalable cross-tenant audit management across all 9 tenants.Role Provisioning: Designed a standardized security request template capturing data needs, scope, duration, and manager approval upfront - eliminating provisioning back-and-forth across HR and functions. AI-Augmented Delivery: Used Claude Code and GPT to build security playbooks, test case libraries, and auto-generated Workday User Guides with screenshots - accelerating documentation and knowledge transfer org-wide.

Education

• Hunter College

  Bachelor of Arts (B.A.), Psychology

  2009 — 2013

• Baruch College

  Master of Science (MS), Labor and Industrial Relations

  2016 — 2019