Manager ITGC Controls and Audit Specialist, SAP and Oracle HCM

We're looking for a senior ITGC specialist who knows SAP and Oracle HCM security well enough to design controls, test them and defend them in front of external auditors. You'll own IT general controls across SAP S/4

HANA and Oracle Fusion HCM for SOX, run the audit cycle with internal and external audit, and fix gaps before they turn into findings.

• Own ITGCs across SAP S/4
  
  HANA and Oracle Fusion HCM for SOX 404, covering access to programs and data, program change management, computer operations and program development.
• Maintain the risk and control over Privileged Access Management (PAM) inclusive of Firefighter access in SAP and Break the Glass (BTG) access in Oracle HCM.
• Maintain the risk and control matrix (RCM), control narratives and process flows, mapped to COSO 2013 and COBIT 2019
• Cover all layers in scope for SAP: application, HANA database and operating system

• Design and maintain SoD rulesets and critical access rules in SAP GRC Access Control and Oracle Risk Management Cloud (Advanced Access Controls)
• Run SAP access provisioning through GRC ARM with SoD simulation before approval
• Own Oracle HCM role provisioning rules and data security profiles so access follows job, department and business unit
• Control privileged and emergency access using SAP Firefighter (EAM), SAP
  * and DDIC, and Oracle HCM IT Security Manager and administrator roles
• Govern SAP change management: SE06 and SCC4 settings, transport approvals through ChaRM or Cloud ALM
• Govern Oracle HCM quarterly updates, configuration migration and Fast Formula changes
• Restrict access to sensitive HCM data: salary, payroll, bank details, national identifiers and other PII

• Run quarterly user access reviews and role content reviews in both systems
• Review Firefighter logs, SAP Security Audit Log (SM20, ) and table logging (SCU3)
• Monitor Oracle HCM audit policies and reports for changes to compensation, payroll elements, employee bank accounts and security setup
• Reconcile HCM terminations and transfers against SAP and Oracle access, and confirm timely removal
• Review HCM Data Loader (HDL) loads, HCM Extracts and interface failures between Oracle HCM and SAP
• Review SAP background jobs (SM37) and Oracle HCM scheduled processes for exceptions
• Lead root cause analysis and remediation when a control fails

• Be the main point of contact for external auditors (Big
  4) and internal audit on ITGCs
• Manage PBC lists, walkthroughs and evidence delivery for interim, year end and roll forward testing
• Support test of design and operating effectiveness, including sample selection and population completeness
• Validate IPE and key reports for completeness and accuracy
• Review the Oracle Cloud SOC 1 Type II report and own the related CUECs

• Push continuous controls monitoring where it makes sense, cutting manual testing
• Run management self assessments and keep control owners trained and accountable

• 10+ years in IT audit, ITGC or SAP security, with Big 4 or public company SOX experience
• Hands on SAP security: roles, SUIM, SU01, PFCG, critical transactions (SE16N, SE38, SM30, SA38), RFC users
• Strong working knowledge of SAP GRC Access Control (ARA, ARM, EAM, BRM)
• Hands on Oracle Fusion HCM security:
  Security Console, role provisioning rules, data security profiles, audit policies
• Experience with Oracle Risk Management Cloud Advanced Access Controls or Advanced HCM Controls
• Understands how HR events drive access across systems, from hire to termination
• Proven record taking a company through clean SOX audits and remediating findings
• Can explain a control failure to an auditor, a developer and a CFO in the same day

• CISA (required)
• CRISC, CISM or CIA
• SAP Certified Application Associate, SAP Access Control

• Healthcare, HIPAA or employee data privacy experience
• Experience with S/4
  
  HANA RISE or Oracle HCM cloud migrations from a controls perspective