Manager ITGC Controls and Audit Specialist, SAP and Oracle HCM

Univedge Consulting LLC; New York (NY); On-site; USD 180,000 - 240,000; Full time

Job summary

Univedge Consulting LLC is seeking a senior ITGC specialist with deep SAP S/4HANA and Oracle Fusion HCM security experience. You will own ITGCs for SOX, drive the audit cycle with internal and external auditors, and remediate gaps before they become findings.

You will design preventive controls, manage access governance, and coordinate change management across SAP and Oracle environments to ensure tight security and compliance.

Qualifications

• 10+ years in IT audit, ITGC or SAP security, with Big 4 or public company SOX experience
• Hands on SAP security: roles, SUIM, SU01, PFCG, critical transactions (SE16N, SE38, SM30, SA38), RFC users
• Strong working knowledge of SAP GRC Access Control (ARA, ARM, EAM, BRM)
• Hands on Oracle Fusion HCM security: Security Console, role provisioning rules, data security profiles, audit policies
• Experience with Oracle Risk Management Cloud Advanced Access Controls or Advanced HCM Controls
• Understands how HR events drive access across systems, from hire to termination
• Proven record taking a company through clean SOX audits and remediating findings
• Can explain a control failure to an auditor, a developer and a CFO in the same day

Responsibilities

• Own the ITGC framework across SAP S/4HANA and Oracle Fusion HCM for SOX 404
• Maintain the risk and control matrix (RCM), control narratives and process flows, mapped to COSO 2013 and COBIT 2019
• Cover all layers in scope for SAP: application, HANA database and operating system
• Maintain Privileged Access Management (PAM) risk and controls including Firefighter access in SAP and Break the Glass in Oracle HCM
• Design and maintain SoD rulesets and critical access rules in SAP GRC Access Control and Oracle Risk Management Cloud
• Run SAP access provisioning through GRC ARM with SoD simulation before approval
• Govern SAP change management: SE06 and SCC4 settings, transport approvals through ChaRM or Cloud ALM
• Govern Oracle HCM quarterly updates, configuration migration and Fast Formula changes
• Restrict access to sensitive HCM data: salary, payroll, bank details, national identifiers and other PII
• Run quarterly user access reviews and role content reviews in both systems
• Review Firefighter logs, SAP Security Audit Log (SM20, RSAU_CONFIG) and table logging (SCU3)
• Monitor Oracle HCM audit policies and reports for changes to compensation, payroll elements, employee bank accounts and security setup
• Reconcile HCM terminations and transfers against SAP and Oracle access, and confirm timely removal
• Review HCM Data Loader (HDL) loads, HCM Extracts and interface failures between Oracle HCM and SAP
• Review SAP background jobs (SM37) and Oracle HCM scheduled processes for exceptions
• Lead root cause analysis and remediation when a control fails
• Be the main point of contact for external auditors (Big 4) and internal audit on ITGCs
• Manage PBC lists, walkthroughs and evidence delivery for interim, year end and rollforward testing
• Support test of design and operating effectiveness, including sample selection and population completeness
• Validate IPE and key reports for completeness and accuracy
• Review the Oracle Cloud SOC 1 Type II report and own the related CUECs
• Push continuous controls monitoring where it makes sense, cutting manual testing
• Run management self assessments and keep control owners trained and accountable

Skills

IT audit

SAP security

GRC Access Control

Oracle Fusion HCM security

SOX compliance

Big 4 experience

Communication with auditors

Education

CISA (required)

CRISC, CISM or CIA

SAP Certified Application Associate, SAP Access Control

Tools

SAP GRC Access Control

Oracle Risk Management Cloud

Oracle HCM IT Security Manager

Job description

We're looking for a senior ITGC specialist who knows SAP and Oracle HCM security well enough to design controls, test them and defend them in front of external auditors. You'll own IT general controls across SAP S/4HANA and Oracle Fusion HCM for SOX, run the audit cycle with internal and external audit, and fix gaps before they turn into findings.

What you'll do

Own the ITGC framework

• Own ITGCs across SAP S/4HANA and Oracle Fusion HCM for SOX 404, covering access to programs and data, program change management, computer operations and program development.
• Maintain the risk and control over Privileged Access Management (PAM) inclusive of Firefighter access in SAP and Break the Glass (BTG) access in Oracle HCM.
• Maintain the risk and control matrix (RCM), control narratives and process flows, mapped to COSO 2013 and COBIT 2019
• Cover all layers in scope for SAP: application, HANA database and operating system

Proactive (preventive) controls

• Design and maintain SoD rulesets and critical access rules in SAP GRC Access Control and Oracle Risk Management Cloud (Advanced Access Controls)
• Run SAP access provisioning through GRC ARM with SoD simulation before approval
• Own Oracle HCM role provisioning rules and data security profiles so access follows job, department and business unit
• Control privileged and emergency access using SAP Firefighter (EAM), SAP* and DDIC, and Oracle HCM IT Security Manager and administrator roles
• Govern SAP change management: SE06 and SCC4 settings, transport approvals through ChaRM or Cloud ALM
• Govern Oracle HCM quarterly updates, configuration migration and Fast Formula changes
• Restrict access to sensitive HCM data: salary, payroll, bank details, national identifiers and other PII

Reactive (detective and corrective) controls

• Run quarterly user access reviews and role content reviews in both systems
• Review Firefighter logs, SAP Security Audit Log (SM20, RSAU_CONFIG) and table logging (SCU3)
• Monitor Oracle HCM audit policies and reports for changes to compensation, payroll elements, employee bank accounts and security setup
• Reconcile HCM terminations and transfers against SAP and Oracle access, and confirm timely removal
• Review HCM Data Loader (HDL) loads, HCM Extracts and interface failures between Oracle HCM and SAP
• Review SAP background jobs (SM37) and Oracle HCM scheduled processes for exceptions
• Lead root cause analysis and remediation when a control fails

Work with auditors

• Be the main point of contact for external auditors (Big 4) and internal audit on ITGCs
• Manage PBC lists, walkthroughs and evidence delivery for interim, year end and rollforward testing
• Support test of design and operating effectiveness, including sample selection and population completeness
• Validate IPE and key reports for completeness and accuracy
• Review the Oracle Cloud SOC 1 Type II report and own the related CUECs

Improve and automate

• Push continuous controls monitoring where it makes sense, cutting manual testing
• Run management self assessments and keep control owners trained and accountable

What you bring

• 10+ years in IT audit, ITGC or SAP security, with Big 4 or public company SOX experience
• Hands on SAP security: roles, SUIM, SU01, PFCG, critical transactions (SE16N, SE38, SM30, SA38), RFC users
• Strong working knowledge of SAP GRC Access Control (ARA, ARM, EAM, BRM)
• Hands on Oracle Fusion HCM security: Security Console, role provisioning rules, data security profiles, audit policies
• Experience with Oracle Risk Management Cloud Advanced Access Controls or Advanced HCM Controls
• Understands how HR events drive access across systems, from hire to termination
• Proven record taking a company through clean SOX audits and remediating findings
• Can explain a control failure to an auditor, a developer and a CFO in the same day

Certifications

• CISA (required)
• CRISC, CISM or CIA
• SAP Certified Application Associate, SAP Access Control

Nice to have

• Healthcare, HIPAA or employee data privacy experience
• Experience with S/4HANA RISE or Oracle HCM cloud migrations from a controls perspective