Workday Security is not a product you buy separately. It is the set of rules inside your Workday system that decides who can see and do what. These rules are usually set up once, at launch, and then patched for years. Then an audit or a reorganization (reorg) forces a proper look. That is usually when companies hire.
Three ideas cover most of it. A security group is a set of people who get the same access, such as "all HR partners". A domain policy decides which groups can see a type of data, like pay or home addresses. A business process policy covers the approval steps Workday runs for things like a hire or a pay change. It decides which groups can start, approve or cancel each step. Access goes to groups, never straight to people.
The figures below come from the vetted consultants on Turbin who list Workday Security. They are the hourly rates consultants set themselves, before Turbin's fee.
How much does a Workday Security consultant cost per hour?
A Workday Security consultant charges a median of $92 an hour, the same as the median across Turbin's whole network. The middle half charge between $80 and $118. Security is the third-largest pool on Turbin, behind only Core HCM and Reporting. Its median is the fifth-highest of the sixteen modules with enough consultants to compare.
The low end is what stands out. A quarter of Security consultants charge $80 or less, against $65 for Core HCM. So even the cheaper Security consultants are priced like specialists.
The table puts Security next to the modules it touches. Access often follows your HCM team structure. Every integration runs under its own security group. And a report shows each person only the data their own access allows.
| Module | Middle half | Median | Certified median |
|---|---|---|---|
| Security Domain and business-process policies, segregation of duties | $80–$118 | $92 | $85 |
| Core HCM Workers, organizations, business processes, security groups | $65–$110 | $80 | $90 |
| Integrations EIB, Core Connectors, web services | $60–$100 | $80 | $100 |
| Studio Complex integrations, orchestration | $80–$120 | $95 | $110 |
| Reporting Custom reports, dashboards, calculated fields | $65–$115 | $85 | $100 |
USD per hour, set by the consultant, before Turbin's fee. Certified median shown where at least ten consultants in the row hold a certification Turbin has validated; "n/a" means fewer than ten.
Security for integrations is often done inside an integration project instead. An integration is a connection that sends data between Workday and another system. Each one should run as its own integration system user (ISU): a system account that gets only the access that one feed needs. For those rates, see the Integrations guide.
Why certification does not raise Security rates
Certification barely moves Security rates. Consultants with a validated Security certification charge a median of $85, which is $7 below the module as a whole. Security is the only module on Turbin where certified consultants charge less than the module median.
Only 11% of Security consultants hold one, the lowest share of any module with enough consultants to compare. With so few, read this as a hint, not a precise figure. Still, the message is clear: the credential is not what clients pay for.
What clients pay for is audits passed and systems rebuilt. Most audit work comes down to segregation of duties (SoD): making sure no one person can both create and approve the same thing. Picture one person who can create a supplier and also pay it. Or hire a worker and set their pay, or enter a journal and approve it.
In Workday, you prevent this by splitting permissions with care across groups. A consultant who has defended that split in front of auditors works very differently from one who has only handed out access.
How groups are built is the other dividing line. Some groups are just lists of named people. That works for a handful of admins, but it does not scale. Better groups add people automatically based on their role or job, so access follows the person when they move.
A system that still grants access by adding names one at a time is the classic redesign project. Your modules matter too. If you run Workday Financials, you have supplier and payment controls that an HR-only system does not.
How to check a Security consultant before you hire
Start with an audit. Ask what the auditors asked for, what they found, and what the consultant produced in response. Someone who has done it will name the sensitive data and approval steps involved.
They will also describe the evidence. That means a list of who holds each sensitive permission, regular access reviews, and a history of security changes. Workday stamps the time of every security change, and an experienced consultant knows to use that record.
Then ask how they would move your system from lists of named people to groups based on roles. Role-based access keeps working after a reorg; lists of names do not. Then ask for a time a reorg broke someone's access. This separates real experience from reading. Listen for a specific story: which teams were split or merged, who lost access, and how they fixed it.
Ask about testing last, because good testing is what protects payday. A good answer has three parts:
- They make changes in a sandbox, a test copy of Workday, first.
- They test by logging in as the affected users, which Workday calls proxying.
- They note when each change goes live, so they can roll back to the earlier version.
A consultant who edits security straight in your live system will sooner or later lock someone out of a task they need that day.
Weigh a certification in proportion: useful if they have one, but not the bar. The certification guide shows how to check one. For Security interview questions and what a strong answer sounds like, see the interview questions guide.
What a Security project costs in total
At the Security median of $92 an hour, Turbin's flat 20% fee brings the bill rate to $110. Through a staffing agency, the same consultant typically bills $129–$184, and most agencies won't say what the consultant is paid. A two-month SoD review before an audit, at 15 hours a week, comes to about $14k. That covers mapping sensitive access to people, fixing conflicts and writing up the evidence.
Six months of ongoing admin at 10 hours a week comes to about $29k. That covers access requests, new roles as your processes change, and security updates after each Workday release.
Budget a redesign after a reorg at the top quarter of the range: $118 an hour, or a $142 bill rate. It is the one Security project where judgment matters more than hours, because a bad redesign costs you the next audit. Four months at 20 hours a week comes to about $49k. That covers rebuilding access around roles, retiring the lists of names, and testing everything in a sandbox.
Most of this work is part-time, and 73% of Security consultants on Turbin take part-time work. Across projects run through Turbin, the median is 15 hours a week for about 6 months. There is no minimum length, and 30 days' written notice ends a project. If the first week is not up to standard, the consultant is replaced within 72 hours at no charge.
Timing matters more here than in most modules, because audits have dates. Through a staffing agency, expect 3–6 weeks from request to a signed consultant, because most agencies start searching only after you ask. On Turbin the median is 48 hours from request to hire. Book before the auditors arrive, not after their findings.
A request that says more than "Workday Security consultant" gets a sharper shortlist. Tell us:
- What triggered it: an audit date, a finding to fix, a reorg or a pile of access requests.
- Which Workday modules you use.
- Roughly how many custom security groups you have.
Questions we get asked.
For routine work, usually yes. A strong HCM or Financials consultant can assign roles, give an existing group access to more data, or handle an access request. Hire a Security specialist for three kinds of work. The first is a segregation of duties (SoD) review before an audit. The second is a redesign after a reorg. The third is a system where access still goes to named people one by one. Security is the third-largest pool on Turbin. A specialist is not hard to find.
Not on these figures. Only 11% of Security consultants on Turbin hold a validated certification for the module. Their median rate is $85, against $92 for the module as a whole. So few are certified that this is a hint, not a precise figure. Read it as "the credential is not what sets Security rates", not "certified is cheaper". Audits passed and redesigns done are the better signs. The rate follows them.
Usually three things. First, a list of who holds each sensitive permission, traced from groups down to named people. Second, proof that clashing permissions are split between people, or that another check covers the risk. Third, a record of every security change, with when it went live and who approved it. Workday stamps the time of each security change. Experienced consultants keep this proof as they go.