Security is not something you license separately. It is the layer of every Workday tenant that decides who can see and do what: domain security policies control access to data, reports and tasks; business process security policies control who can initiate, approve, correct or cancel each step; and both grant access to security groups rather than to people. It tends to be configured once at implementation and then patched for years, until an audit or a reorganization forces a proper look. That is usually when the hire happens.
The figures below come from the vetted consultants on Turbin who list Workday Security, and from the hourly rates they set on their own profiles, before Turbin's fee.
How much does a Workday Security consultant cost per hour?
The median Workday Security consultant sets $92 an hour, the same as the median across the whole network, and the middle half of the pool sits between $80 and $118. Security is the third-largest pool on Turbin, behind only Core HCM and Reporting. Its median is the fifth-highest of the sixteen modules with 30 or more profiles.
The floor is what stands out. A quarter of Security consultants set $80 or less, against $65 for Core HCM, so even the lower end of the pool prices like specialists. The table puts Security next to the modules it touches: roles are assigned on HCM organizations, every integration runs under its own security group, and reports inherit the access of the person running them.
| Module | Middle half | Median | Certified median |
|---|---|---|---|
| Security Domain and business-process policies, segregation of duties | $80–$118 | $92 | $85 |
| Core HCM Workers, organizations, business processes, security groups | $65–$110 | $80 | $90 |
| Integrations EIB, Core Connectors, web services | $60–$100 | $80 | $100 |
| Studio Complex integrations, orchestration | $80–$120 | $95 | $110 |
| Reporting Custom reports, dashboards, calculated fields | $65–$115 | $85 | $100 |
USD per hour, set by the consultant, before Turbin's fee. Certified median shown where at least ten consultants in the row hold a certification Turbin has validated; "n/a" means fewer than ten.
Integration security (one integration system user per integration, in its own integration system security group) is often scoped inside an integration project rather than as Security work. For those rates, see the Integrations guide.
Why certification does not price Security work
Certification barely registers in Security pricing: consultants holding a validated Security certification set a median of $85, $7 below the module, and Security is the only module on Turbin where the certified median sits below the module median. Only 11% of Security consultants hold one, the lowest share of any module with 30 or more profiles. The certified sample is small, but the direction is clear: the credential is not what clients pay for.
What they pay for is audits survived and tenants redesigned. The core of most audit work is segregation of duties: making sure no one person can complete a sensitive cycle alone, such as creating a supplier and paying it, hiring a worker and setting their pay, or entering and approving the same journal. In Workday that comes down to how domain and business process permissions are split across security groups, and a consultant who has defended that split in front of auditors works differently from one who has only assigned roles.
The group model is the other dividing line. User-based groups name individuals and suit a handful of administrators. Role-based and job-based groups derive membership from role assignments or job details, and come constrained (access only to the organizations the role covers) or unconstrained (access to everything). Intersection groups require membership in several groups at once; aggregation groups combine several. A tenant still granting access by adding names to user-based groups is the classic redesign, and scope matters as well: a tenant running Financials has supplier and payment controls an HCM-only tenant does not.
How to check a Security consultant before you hire
Start with an audit. Ask what the auditors requested, what they found, and what the consultant produced in response. Someone who has done it names the sensitive domains, the business process steps in question and the format of the evidence: who holds each sensitive permission, periodic access reviews, and a history of security changes. Workday records every activation of pending security policy changes with a timestamp, and a consultant who has been audited knows to use it.
Then ask how they would move a tenant from user-based groups to role-based ones. Access granted by role assignment on organizations scales and survives a reorganization; access granted by adding names does neither. Follow with the question that separates practitioners from people who have only read about it: when is a constrained group right, when is an unconstrained one, and when did a constrained group break after an organization was split or merged?
Ask about testing discipline last, because it is the one that protects pay day. A good answer is changes made in a sandbox, tested by proxying as the affected users, and activated with a note of the timestamp so an earlier one can be reactivated to roll back. A consultant who edits policies directly in production will eventually lock someone out of a business process they need that day.
Weigh a certification in proportion: useful when offered, not the bar, and the certification guide shows how to check one. Security scenarios with what a strong answer sounds like are in the interview questions guide.
What a Security engagement costs in total
At the Security median of $92 an hour, Turbin's flat 20% brings the bill rate to $110. A two-month segregation-of-duties review before an audit at 15 hours a week (map sensitive domains and business process steps to people, fix the conflicts, document the evidence) comes to about $14k. Six months of administration at 10 hours a week (access requests, new roles for new business processes, release-driven policy changes) is about $29k.
A redesign after a reorganization is worth pricing at the upper quartile, $118 an hour or a $142 bill rate, because it is the one Security engagement where judgement matters more than hours: a redesign done badly costs you the next audit. Four months at 20 hours a week (role assignments, constrained groups, user-based groups retired, everything tested by proxy in a sandbox) comes to about $49k.
Most of this work is part-time, and 73% of Security consultants on Turbin take part-time work. Across engagements run through Turbin to date, the median is 15 hours a week for about 6 months. There is no minimum engagement, 30 days' written notice ends one, and if the first week is not billing-quality the consultant is replaced within 72 hours at no charge.
Timing matters more here than in most modules, because audits have dates. Through a staffing agency, expect 3–6 weeks from request to a signed consultant; on Turbin the median is 48 hours from request to hire. Book before the auditors arrive, not after their findings. A request that says what triggered it (an audit date, a finding to remediate, a reorganization or an access-request backlog), which modules are live, and roughly how many custom security groups you have gets a sharper shortlist than "Workday Security consultant".
Questions we get asked.
For routine work, such as assigning roles, adding a domain to an existing group or answering an access request, a strong HCM or Financials consultant usually can. Hire Security specifically for a segregation-of-duties review before an audit, a redesign after a reorganization, or a tenant still running on user-based groups. On Turbin, Security is the third-largest pool on the network, so a specialist is not hard to find.
Not on this data. Only 11% of Security consultants on Turbin hold a validated certification for the module, and their median rate is $85, against $92 for the module as a whole. The certified sample is small, so read it as "certification is not what prices Security work" rather than "certified is cheaper". Audit cycles survived and redesigns delivered are the better signals, and the ones the rate follows.
Typically three things: who holds each sensitive permission (which security groups are granted which domains and business process steps, resolved to named people), evidence that conflicting permissions are separated or compensated for, and a record of every security policy change with when it was activated and who approved it. Workday timestamps each activation of security policy changes, so a consultant who has been through an audit builds that evidence as they work.