SAP Security & GRC Lead

Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4

HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.

This role is a remote role based out of Atlanta, GA.

• Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans.
• Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards.
• Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately.
• Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.

• Own the SAP security architecture and role design strategy across S/4
  
  HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems.
• Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes.
• Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification.
• Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes.
• Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design.
• Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP.

• Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels.
• Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly.
• Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes.
• Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort.
• Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits.

• Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare.
• Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units.
• Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment.
• Plan and execute security cutover activities and provide go-live and post-go-live support.
• Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables.

• Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits.
• Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis.
• Lead periodic user access reviews and train control owners to complete them accurately and on time.
• Ensure role provisioning and user access privileges comply with company security policies and SOX regulations.

• • Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders.
  • Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across…