SAP Security & GRC Lead

About the role

Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.

Job Location: This role is a remote role based out of Atlanta, GA.

Responsibilities

• Team Leadership & Contractor Management: Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans; direct day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards; establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately; serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.
• Security Architecture & GRC Governance: Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems; establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes; own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification; own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes; evaluate business risks associated with role design, implement