Technology Operations & Security Coordinator Intern

Technology Operations & Security Coordinator
Harvard Student Agencies | Part-time, hourly | Academic year (with possible summer extension)

The Role

HSA runs on a shared set of tools, including Google Workspace, Slack, Ramp, Shopify, and a Microsoft Azure environment that supports our Business Office. Nearly our entire workforce turns over every year. That combination creates predictable problems:

• Accounts outlive the people who use them.
• Ownership of shared logins and files gets messy.
• Credentials get passed along informally.
• Software and services are added or removed without first determining who else depends on them.
• Sensitive data ends up in places no one is tracking.

The Technology Operations & Security Coordinator will help HSA get its technology house in order and keep it that way. You will:

• Audit and clean up who has access to what.
• Map where our data lives and how it is protected.
• Make sure every software change is evaluated against the needs of the whole organization, not just one individual or team.
• Keep HSA in compliance with its payment card, insurance, recordkeeping, and data security obligations.
• Serve as the first point of contact for our permanent staff's technology needs.

Most importantly, you will document all of it, so that next year's team can run the system without you.

You will report to HSA's Chief Technology Officer. You will work closely with the General Manager, the Business Office, the Chief People Officer, and Patrick Carroll, HSA's marketing and technology agency partner.

What You'll Do

Access and account lifecycle

• Audit users, roles, and permissions across Google Workspace, Slack, Ramp, Shopify, Azure, and the rest of the HSA technology stack. This includes domains, website and e-commerce platforms, payment accounts, and social media and advertising accounts.
• Flag dormant accounts, orphaned ownership, over-broad access, and unreviewed third-party app connections, and help remediate what you find.
• Partner with the Chief People Officer, who leads hiring, training, and departures, to build onboarding and offboarding checklists. Every new hire should get the right access on day one, and every departure should be closed out appropriately.
• Before any account is suspended or deleted, make sure its files, folders, and tool ownership are transferred to HSA. Closing an account should never cost HSA its records.
• Move business-critical files out of individual students' personal Google Drives and into Shared Drives owned by HSA.
• Establish clear ownership for shared accounts and admin seats, including how ownership transfers at each annual transition.
• Lead HSA's move to enforced multi-factor authentication, and to passkeys wherever they are supported.
• Define how credentials are created, stored, and shared. Move teams away from simple, weak passwords and informal practices such as texted/Slacked passwords and logins kept in shared documents.
• Create a simple, repeatable process for requesting, approving, granting, and revoking access, including a periodic access review.

Data protection and retention

• Build and maintain an inventory of HSA's sensitive data. This covers customer, client, employee, and payment information: where it lives, who can access it, and how long we keep it.
• Identify and reduce data exposure, including files shared publicly, shared with personal accounts, or stored outside HSA systems.
• Work with the Business Office and the Chief People Officer to develop data handling and retention policies. These include rules for personal devices and accounts, as well as retention schedules that meet IRS, government reporting, and other recordkeeping requirements.
• Help incorporate these policies into the employee handbook and the annual employee sign-off completed through Paycom.
• Help maintain HSA's written information security program, as required by Massachusetts data security regulations (201 CMR 17.00).
• Help maintain a simple incident response plan covering who to contact and what to do if an account is compromised, a device is lost, or data is exposed.
• Develop a brief security orientation for the incoming team each fall, covering phishing, password manager use, data handling, and how to report a problem.

Software governance and spend

• Maintain an inventory of every software tool, add-on (including Shopify apps), and integration HSA uses. For each, record its owner, purpose, the teams and records that depend on it, seat count, cost, renewal date, and any other relevant metadata.
• Establish and maintain a software change process, such that no tool, add-on, integration, payment account, or payment plan is added, changed, or discontinued without review by (at least) the Business Office and the CTO.
• Evaluate proposed software early in the adoption lifecycle, before the decision phase. Consider factors such as how well it integrates with HSA's existing systems and financial controls, whether it supports the integration, maintenance, and automation of financial data (where relevant), how data can be exported, and what it costs.
• Before any tool is discontinued, document who relies on it and what data or functions it provides. Preserve all records required for tax, government reporting, and recordkeeping purposes, and confirm a replacement or transition plan.
• Identify unused seats, duplicate tools, and unnecessary spend, and work with the Business Office on renewals and cancellations.
• Pursue nonprofit pricing and grants available to HSA as a 501(c)(3) organization.

Compliance

• Prepare HSA's annual PCI DSS Self-Assessment Questionnaires for each merchant account, gather supporting evidence, and coordinate review and sign-off by HSA leadership.
• Maintain the controls and records HSA's cyber insurance policy requires, such as multi-factor authentication, backups, and security training. Help prepare the annual renewal application.

Infrastructure and staff technology support

• Develop a working understanding of the Microsoft Azure environment that supports the Business Office's finance and accounting systems. Document its components, accounts, and dependencies, and coordinate routine maintenance with HSA leadership and any outside vendors.
• Provide first-line technical support to HSA's permanent staff using Windows and macOS, including software, hardware, network connectivity (including Harvard Secure), and copiers and printers.
• Serve as HSA's primary liaison to Harvard University Information Technology (HUIT) for the services it supports, escalating and tracking issues through resolution.

Documentation and continuity

• Write documentation that a successor with no prior context can pick up and run.
• Test changes with agency managers and the Business Office, and roll them out with minimal disruption to day-to-day operations.
• Help recruit and train your successor, including a transition period before you leave the role.
• Perform other duties as assigned to support HSA's security, compliance, and technology operations.

Who We're Looking For

• Exceptionally organized and detail-oriented. You build checklists, follow them, and notice what is missing.
• Process-minded. You enjoy turning messy, one-off work into clear, repeatable systems.
• Technically curious. You are comfortable troubleshooting Windows and macOS, learning unfamiliar admin consoles on your own, and asking good questions when you're stuck.
• Interested in how technology and people work together. Much of this job is helping busy managers adopt new habits, not configuring software.
• Service-minded and patient. You enjoy helping colleagues solve problems, and you can explain technical issues without jargon.
• A clear writer. Documentation is a core deliverable, not an afterthought.
• Trustworthy and discreet. The role involves administrative access to sensitive systems and financial information.
• A current Harvard College student available during the academic year. Students interested in continuing to work over the summer are strongly preferred.

A computer science background or prior security experience is not required. Familiarity with password managers, two-factor authentication, or passkeys is a plus. So is any prior experience administering Google Workspace, Slack, Ramp, Shopify, Microsoft Azure, or similar tools, or providing technical support.

Details

This is a part-time, hourly position during the academic year, with approximately 10-15 hours per week scheduled around your classes, paid at the rate of $24/hour. Hours may be heavier at the start and end of the academic year, during HSA’s annual training and transition period. The successful candidate will sign a confidentiality agreement.