How do I set up default KeyNet roles for new employees?

In Keystone Client, go to KEMS System Administration Menu -> KEMS Parameters -> KEMS Site Parameters (KE0294) and click "Web Settings":

Select the WEBSEC Parameters (KE0626)

Set the default roles that you want assigned to every new employee (either KeyNet KEMS Roles or KeyNet FIN Roles)