Hello Thad,
I’m not sure that I get correctly, but you can use the Role criteria based on the ‘Basic IT Users’ entitlement, if I understood correctly the ‘Basic IT Users’ always have the same entitlements, so you can filter something like this at your ‘Financial Users’ Role:
entitlements EQUALS 'Basic IT Entitlement Name' (Intranet for ex)
AND
department EQUALS 'Financial'
Let me know if this what you want to achieve.
Regards,