Security Migration Professional

Senior Mainframe Security Architect / ACF2 to RACF Migration Lead
Experience: 12–15+ Years
Locations: Bangalore / Pune / Chennai
Domain: Mainframe Security | ACF2 | RACF | Security Migration & Modernization
Role Summary
We are looking for a highly experienced Mainframe Security Architect / ACF2-to-RACF Migration Lead to lead the assessment, architecture, engineering, conversion, testing, and operational transition of enterprise Mainframe security from CA ACF2 to IBM RACF.
The role requires deep hands-on expertise in ACF2, RACF, SAF-based security architecture, security conversion, RBAC, privileged access, and subsystem security integration across z/OS environments.
The candidate will work closely with Mainframe Infrastructure, Security, Application, Compliance, Testing, and Operations teams to ensure a controlled and auditable migration with minimal business disruption.
Key ResponsibilitiesRACF Engineering
Design, configure, and administer the RACF database and security environment.
Strong hands-on experience with SETROPTS, RACF class activation and configuration.
Design and manage RACF user IDs, groups, group hierarchy, profiles, ownership, CONNECTs, PERMITs and access levels.
Design dataset and general resource profiles using appropriate generic and discrete profile strategies.
Configure and validate UACC, audit attributes, warning mode and class-specific controls.
Support RACF database backup, recovery, operational controls, and production readiness.
ACF2 Analysis & Assessment
Perform detailed assessment of existing ACF2 security configurations.
Analyze LogonIDs, UID strings, dataset rules, resource rules, scopes and privileged IDs.
Identify complex rules, exceptions, wildcard patterns, shared IDs, elevated access and application-specific security dependencies.
Analyze current ACF2 security constructs and determine their appropriate RACF equivalents.
Identify security gaps, redundant access and migration exceptions requiring remediation or design decisions.
ACF2-to-RACF Conversion
Define and execute the end-to-end ACF2-to-RACF migration approach.
Map ACF2 LogonIDs, UID structures, dataset rules and resource rules to RACF users, groups, profiles and permissions.
Develop or validate migration extracts, transformation logic and RACF command streams.
Execute migration loads and produce source-to-target comparison and reconciliation reports.
Analyze conversion exceptions and coordinate remediation.
Ensure migration completeness, accuracy, traceability and auditability.
Support dry runs, dress rehearsals, production cutover and post-migration validation.
Mainframe Security Architecture
Define target-state security architecture covering ACF2, RACF, SAF and RACROUTE integration.
Establish RACF class strategy, profile design standards and group hierarchy.
Define security design principles for dataset, resource and subsystem protection.
Review application and infrastructure security requirements and translate them into RACF controls.
Drive security architecture decisions, standards and technical governance.
RBAC & Access Governance
Design and implement Role-Based Access Control (RBAC) models.
Define role taxonomy, business/technical roles and access packages.
Support least privilege, Segregation of Duties (SoD), access certification and periodic access review.
Identify excessive or conflicting access during migration and recommend remediation.
Ensure target RACF structures support sustainable access governance and administration.
Privileged Access Management
Design and review privileged access including:
RACF SPECIAL
OPERATIONS
AUDITOR
Group-SPECIAL
Emergency/Break-glass access
Restricted and service IDs
System and application privileged IDs
Ensure privileged access is appropriately controlled, monitored and auditable.
Subsystem Security Integration
Provide security architecture and migration support across:
z/OS
CICS
Db2
IBM MQ
IMS
USS / OMVS
JES2
Storage
Scheduling and Automation products
Other SAF-enabled Mainframe products
Validate subsystem-specific resource classes, profiles and access requirements during the ACF2-to-RACF conversion.
Technical Tooling
Strong working knowledge of:
JCL
REXX
ISPF
SMF
RACF IRR utilities
RACF reporting and diagnostic utilities
IBM Security zSecure or equivalent security administration/reporting tools
Security extraction, transformation, reconciliation and validation utilities
Ability to develop or review automation used for security migration, validation and reporting is highly desirable.
Migration Testing & Cutover
Define security migration test strategy and acceptance criteria.
Coordinate unit, integration, regression and access validation testing.
Validate critical user, application, batch and subsystem access.
Develop cutover runbooks and execution checklists.
Define backup, recovery and rollback procedures.
Support migration rehearsals and production cutover.
Produce migration evidence, reconciliation results and security sign-off documentation.
Governance & Operational Readiness
Coordinate with client security teams, infrastructure teams, application teams and technology vendors.
Lead security design discussions and document architecture decisions.
Track security exceptions, risks, remediation actions and risk acceptance.
Support control validation and security/compliance sign-off.
Maintain migration evidence and audit documentation.
Develop operational procedures and support BAU handover and knowledge transition.
Ensure the target RACF environment is supportable after migration.
Mandatory Skills
Strong hands-on expertise in:
ACF2 | RACF | SAF | RACROUTE | ACF2-to-RACF Migration | RACF Engineering | Mainframe Security Architecture | RBAC | Privileged Access | z/OS Security | JCL | REXX | SMF | IRR Utilities | Security Migration Testing & Cutover
Good security integration knowledge across CICS, Db2, MQ, IMS, USS and JES2 is required.
Preferred Experience
12–15+ years of Mainframe Security experience.
Significant hands-on experience administering both ACF2 and RACF.
Proven experience in enterprise-scale ACF2-to-RACF or equivalent External Security Manager migration.
Experience designing RACF group structures, profiles, access models and privileged-access controls.
Experience handling large-scale security databases and complex enterprise access rules.
Strong understanding of audit, compliance, SoD and least-privilege principles.
Experience working with geographically distributed Mainframe Infrastructure, Security and Application teams.
Ideal Candidate
The ideal candidate should combine deep hands-on Mainframe security engineering expertise with security architecture and migration leadership capabilities.
The person should be capable of understanding the existing ACF2 environment, defining the target RACF architecture, driving automated or tool-assisted conversion, resolving complex security exceptions, coordinating subsystem integration, supporting cutover, and taking the environment through to audit-ready BAU handover.

Work arrangement
Hybrid