Most mid-sized companies do not have a data access problem on paper. They have a policy, an IT lead and a login system. What they often lack is a person whose job it is to say who can see what, and to check that this is still true a year later.
That is a staffing gap, and it is easier to close than a tooling gap.
Why access drifts
People change roles. A bookkeeper becomes an assistant controller. A plant scheduler moves into purchasing. A sales rep gets temporary access to pricing data for one quote. Rarely does anyone remove the old permissions.
After a few years, you have employees who can see payroll, customer lists or margin data they have no reason to touch. When one of those accounts is compromised, the damage is wider than it should be.
The fix is not complicated. It is just nobody's job in many companies.
Three places this shows up in hiring
1. Finance and accounting. Controllers know that segregation of duties is an audit issue as much as a security one. The person who approves payments should not be able to set up vendors. When you hire a staff accountant or AP lead, the access they receive on day one should be written down, matched to the role and reviewed when they move up.
2. Operations and manufacturing. Plants run on ERP, scheduling and quality systems, and many are adding connected equipment. Supervisors, temporary workers and outside contractors often share logins or inherit broad rights because the line cannot wait. That is where shortcuts pile up.
3. AI and data projects. Copilots, internal chat tools and analytics models read whatever data they are pointed at. If your permissions are loose, the tool will happily surface payroll files or customer records to someone who should not see them. Before you hire a data analyst or AI engineer, decide what that person and their tools are allowed to touch.
The roles that carry this work
You do not need a large team. You do need clear ownership. Depending on your size, the work lands with one or more of these:
- IT or systems administrator who manages accounts, onboarding and offboarding
- Security analyst or IT security lead who monitors activity and runs reviews
- Data analyst or data engineer who knows where sensitive data sits and how it is labelled
- Business systems analyst who connects what finance, operations and sales need with how systems are set up
- Compliance or privacy lead who tracks obligations under PIPEDA, provincial privacy laws, state laws and sector rules
In a company of 100 to 500 people, one or two of these may be the same person. That is fine. What matters is that someone is named.
What to look for when you hire
Technical skill matters, but the harder trait is the ability to say no politely and explain why. A good access owner works with department heads who want things fast.
Screen for these:
- Experience with role-based access and regular permission reviews, not only setting up accounts
- Comfort working with finance, HR and operations managers, not just IT peers
- A clear view of the difference between sensitive and routine data
- Practical knowledge of the systems you run, whether that is a specific ERP, a cloud platform or a CRM
- For AI roles, some understanding of how models and copilots inherit user permissions
Ask candidates to describe a time they removed access someone had held for years. Their answer tells you whether they have actually done the job.
Contract help for the cleanup
The first review is the hardest. Years of accumulated permissions have to be sorted, questioned and trimmed. That is a project, not a permanent headcount.
A contract systems analyst or security specialist can run a three to six month access clean-up, document the roles and hand over a process your own team can maintain. This is also a sensible way to prepare before a cloud migration, an audit or an AI rollout, when a mess in permissions gets copied into the new system.
Build it into onboarding and exits
Two moments cause most of the drift, so tie ownership to them:
- Hiring and transfers. Each role gets a defined set of access. When someone moves, the old set is removed as the new one is added.
- Departures. Access ends the day the person leaves, including contractors and temporary staff. HR and IT need a shared checklist, and someone has to be accountable for it.
Quarterly reviews by department managers, backed by a short report from IT, catch most of what is left.
What to do next
Pick one system that holds sensitive data, such as payroll, your ERP or your customer database, and list who can see it. Compare the list with current job titles. You will probably find people who should not be there, and you will learn whether you need a new hire, a contractor or just a clearer owner.
If the answer is a hire, a Traverse recruiter can help you define the role and find people in IT, data, finance or operations who have done this work before.