SAP Security & GRC Lead
Infrastructure Products Group
Atlanta, Georgia, United States
Job ID: 529787
Job SummaryOldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.
Job LocationThis role is a remote role based out of Atlanta, GA.
Job ResponsibilitiesTeam Leadership & Contractor Management- Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans.
- Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards.
- Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately.
- Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.
Security Architecture & GRC Governance- Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems.
- Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes.
- Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification.
- Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes.
- Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design.
- Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP.
BAU Security Operations- Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels.
- Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly.
- Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes.
- Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort.
- Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits.
New Rollouts & Project Delivery- Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare.
- Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units.
- Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment.
- Plan and execute security cutover activities and provide go-live and post-go-live support.
- Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables.
Audit, Compliance & Risk- Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits.
- Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis.
- Lead periodic user access reviews and train control owners to complete them accurately and on time.
- Ensure role provisioning and user access privileges comply with company security policies and SOX regulations.
Stakeholder Management & Reporting- Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders.
- Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across infrastructure and development practices.
- Conduct analysis sessions with end users and business SMEs to understand access needs and translate them into secure role designs.
Job Requirements- 10+ years of SAP security experience, including hands-on GRC Access Control and ECC/S/4HANA/Fiori security.
- 2+ years leading security teams, contractors, or SI/AMS partners in a team-lead or supervisory role.
- Participated in at least two SAP full-cycle implementations, rollouts, or major upgrade projects, including cutover and go-live support.
- Thorough understanding of the SAP authorization concept and role-based access control, with extensive experience in role design, build, and maintenance.
- In-depth knowledge of SoD governance, security rules, mitigating controls, and Firefighter/emergency access management.
- Thorough understanding of SOX ITGC controls and experience supporting internal and external audits.
- Knowledge of information security and IT risk management frameworks (e.g., NIST) and identity and access management tools and processes.
- Ability to speak to infrastructure-level security concerns and work with technical teams to address them.
- Excellent communication and stakeholder-management skills, with the ability to engage leadership, auditors, business users, and vendors.
- Strong analytical, problem-solving, and troubleshooting skills, with the ability to balance BAU support and project priorities.
- Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience.
- Experience securing SAP BTP and related cloud services (e.g., Datasphere, SAP Analytics Cloud).
- Experience with ServiceNow (or similar) integration with SAP GRC for access request management.
- Experience automating provisioning and access review processes.
- SAP Security and/or GRC training or certification.
Compensation- Base salary range of $100,000-130,000 per year
- Bonus opportunity 15%
- 401(k) plan / group retirement savings program
- Short-term and long-term disability benefits
- Life insurance
- Health, dental, and vision insurance
- Paid time off
- Paid holidays
What CRH Offers You- Highly competitive base pay
- Comprehensive medical, dental and disability benefits programs
- Group retirement savings program
- Health and wellness programs
- An inclusive culture that values opportunity for growth, development, and internal promotion
