SAP Security & GRC Lead

Job Summary

Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.

Job Location

This role is a remote role based out of Atlanta, GA.

Job Responsibilities

Team Leadership & Contractor Management

• Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans.
• Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards.
• Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately.
• Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.

Security Architecture & GRC Governance

• Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems.
• Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes.
• Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification.
• Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes.
• Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design.
• Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP.

BAU Security Operations

• Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels.
• Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly.
• Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes.
• Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort.
• Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits.

New Rollouts & Project Delivery

• Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare.
• Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units.
• Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment.
• Plan and execute security cutover activities and provide go-live and post-go-live support.
• Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables.

Audit, Compliance & Risk

• Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits.
• Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis.
• Lead periodic user access reviews and train control owners to complete them accurately and on time.
• Ensure role provisioning and user access privileges comply with company security policies and SOX regulations.

Stakeholder Management & Reporting

• • Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders.
  • Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across infrastructure and development practices.
  • Conduct analysis sessions with end users and business SMEs to understand access needs and translate them into secure role designs.

Job Requirements

• 10+ years of SAP security experience, including hands-on GRC Access Control and ECC/S/4HANA/Fiori security.
• 2+ years leading security teams, contractors, or SI/AMS partners in a team-lead or supervisory role.
• Participated in at least two SAP full-cycle implementations, rollouts, or major upgrade projects, including cutover and go-live support.
• Thorough understanding of the SAP authorization concept and role-based access control, with extensive experience in role design, build, and maintenance.
• In-depth knowledge of SoD governance, security rules, mitigating controls, and Firefighter/emergency access management.
• Thorough understanding of SOX ITGC controls and experience supporting internal and external audits.
• Knowledge of information security and IT risk management frameworks (e.g., NIST) and identity and access management tools and processes.
• Ability to speak to infrastructure-level security concerns and work with technical teams to address them.
• Excellent communication and stakeholder-management skills, with the ability to engage leadership, auditors, business users, and vendors.
• Strong analytical, problem-solving, and troubleshooting skills, with the ability to balance BAU support and project priorities.
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience.
• Experience securing SAP BTP and related cloud services (e.g., Datasphere, SAP Analytics Cloud).
• Experience with ServiceNow (or similar) integration with SAP GRC for access request management.
• Experience automating provisioning and access review processes.
• SAP Security and/or GRC training or certification.

Compensation

• Base salary range of $100,000-130,000 per year ​​
• Bonus opportunity 15%
• 401(k) plan​ / group retirement savings program​
• Short-term and long-term disability benefits​​
• Life insurance​
• Health, dental, and vision insurance​
• Paid time off ​
• Paid holidays