SAP Security & GRC Lead

OLDCASTLE INFRASTRUCTURE, INC.; Atlanta (GA); Remote; USD 100,000 - 130,000; Full time

Job summary

Oldcastle Infrastructure, Inc. is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of SAP security across S/4HANA, Fiori, and BTP, coordinating with SAP BASIS and development teams.

The role leads a small security team, driving BAU provisioning, SoD governance, and access recertification, while guiding security for new rollouts and audits under SOX.

Qualifications

• 10+ years of SAP security experience including GRC Access Control and SAP S/4HANA/Fiori security.

Responsibilities

• Lead SAP security and GRC workstreams for new rollouts from design to go-live.
• Own SAP security architecture, role design, and production/non-production controls.
• Oversee BAU user provisioning, access requests, and security incident resolution.
• Coordinate with cross-functional teams including Basis, Development, and Infrastructure.
• Manage audits and provide evidence and analysis for SOX compliance.

Skills

SAP security

GRC Access Control

SoD governance

Role design

BAU security ops

Audit & SOX

IAM & access

Security architecture

Team leadership

Education

Bachelor's degree in Computer Science or related

Tools

SAP GRC

ServiceNow

SAP BTP

Fiori

S/4HANA/SAP security

Job description

Job Summary

Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.

Job Location

This role is a remote role based out of Atlanta, GA.

Job Responsibilities

Team Leadership & Contractor Management

• Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans.
• Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards.
• Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately.
• Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.

Security Architecture & GRC Governance

• Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems.
• Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes.
• Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification.
• Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes.
• Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design.
• Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP.

BAU Security Operations

• Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels.
• Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly.
• Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes.
• Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort.
• Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits.

New Rollouts & Project Delivery

• Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare.
• Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units.
• Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment.
• Plan and execute security cutover activities and provide go-live and post-go-live support.
• Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables.

Audit, Compliance & Risk

• Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits.
• Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis.
• Lead periodic user access reviews and train control owners to complete them accurately and on time.
• Ensure role provisioning and user access privileges comply with company security policies and SOX regulations.

Stakeholder Management & Reporting

• • Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders.
  • Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across infrastructure and development practices.
  • Conduct analysis sessions with end users and business SMEs to understand access needs and translate them into secure role designs.

Job Requirements

• 10+ years of SAP security experience, including hands-on GRC Access Control and ECC/S/4HANA/Fiori security.
• 2+ years leading security teams, contractors, or SI/AMS partners in a team-lead or supervisory role.
• Participated in at least two SAP full-cycle implementations, rollouts, or major upgrade projects, including cutover and go-live support.
• Thorough understanding of the SAP authorization concept and role-based access control, with extensive experience in role design, build, and maintenance.
• In-depth knowledge of SoD governance, security rules, mitigating controls, and Firefighter/emergency access management.
• Thorough understanding of SOX ITGC controls and experience supporting internal and external audits.
• Knowledge of information security and IT risk management frameworks (e.g., NIST) and identity and access management tools and processes.
• Ability to speak to infrastructure-level security concerns and work with technical teams to address them.
• Excellent communication and stakeholder-management skills, with the ability to engage leadership, auditors, business users, and vendors.
• Strong analytical, problem-solving, and troubleshooting skills, with the ability to balance BAU support and project priorities.
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience.
• Experience securing SAP BTP and related cloud services (e.g., Datasphere, SAP Analytics Cloud).
• Experience with ServiceNow (or similar) integration with SAP GRC for access request management.
• Experience automating provisioning and access review processes.
• SAP Security and/or GRC training or certification.

Compensation

• Base salary range of $100,000-130,000 per year
• Bonus opportunity 15%
• 401(k) plan / group retirement savings program
• Short-term and long-term disability benefits
• Life insurance
• Health, dental, and vision insurance
• Paid time off
• Paid holidays

What CRH Offers You

• Highly competitive base pay
• Comprehensive medical, dental and disability benefits programs
• Group retirement savings program
• Health and wellness programs
• An inclusive culture that values opportunity for growth, development, and internal promotion

About CRH

CRH has a long and proud heritage. We are a collection of hundreds of family businesses, regional companies and large enterprises that together form the CRH family. CRH operates in a decentralized, diversified structure that allows you to work in a small company environment while having the career opportunities of a large international organization.

CRH Americas Building Products (ABP), a CRH Company, is an affirmative action and Equal Opportunity Employer.

EOE/Vet/Disability

CRH is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, status as a protected veteran or any other characteristic protected under applicable federal, state, or local law.

AI tools may be used in certain stages of the employment lifecycle, such as candidate review; however, all final employment decisions will be made by a person.