SAP Security & GRC Lead

Oldcastle; Atlanta (GA); Remote; USD 100,000 - 130,000; Full time

Benefits offered by this job

Medical insurance

401(k)

Disability benefits

Life insurance

Paid time off

Job summary

CRH Americas Building Products seeks an SAP Security & GRC Lead to own security architecture, governance, and BAU operations across SAP S/4HANA, Fiori, and BTP. Lead a small security team and partner with Audit and Risk & Compliance to maintain SOX compliance.

Responsibilities cover design, role-based access control, and continuous improvement for secure deployments and new rollouts across SAP and integrated applications.

Qualifications

• 10+ years SAP security experience, including GRC Access Control and S/4HANA/Fiori security.
• Proven ability to lead security teams and manage contracts/SI partners.
• Experience supporting SOX ITGC and internal/external audits.

Responsibilities

• Lead SAP security and GRC workstreams for rollouts and enhancements.
• Own SAP security architecture, role design, and access controls across SAP stack.
• Oversee BAU provisioning, access requests, and incident resolution.
• Coordinate with auditors, risk, and compliance to ensure SOX alignment.

Skills

SAP Security

GRC Access Control

SOX ITGC

Leadership

Stakeholder Management

Audit Support

Cloud/SAP BTP

Education

Bachelor's degree in Computer Science or related field

Tools

ServiceNow integration

SAP GRC

SAP BTP

Job description

Job Summary

Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business.

Job Location

This role is a remote role based out of Atlanta, GA.

Job Responsibilities

Team Leadership & Contractor Management

• Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans.
• Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards.
• Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately.
• Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff.

Security Architecture & GRC Governance

• Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems.
• Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes.
• Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification.
• Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes.
• Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design.
• Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP.

BAU Security Operations

• Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels.
• Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly.
• Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes.
• Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort.
• Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits.

New Rollouts & Project Delivery

• Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare.
• Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units.
• Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment.
• Plan and execute security cutover activities and provide go-live and post-go-live support.
• Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables.

Audit, Compliance & Risk

• Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits.
• Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis.
• Lead periodic user access reviews and train control owners to complete them accurately and on time.
• Ensure role provisioning and user access privileges comply with company security policies and SOX regulations.

Stakeholder Management & Reporting

• Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders.
• Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across infrastructure and development practices.
• Conduct analysis sessions with end users and business SMEs to understand access needs and translate them into secure role designs.

Job Requirements

• 10+ years of SAP security experience, including hands-on GRC Access Control and ECC/S/4HANA/Fiori security.
• 2+ years leading security teams, contractors, or SI/AMS partners in a team-lead or supervisory role.
• Participated in at least two SAP full-cycle implementations, rollouts, or major upgrade projects, including cutover and go-live support.
• Thorough understanding of the SAP authorization concept and role-based access control, with extensive experience in role design, build, and maintenance.
• In-depth knowledge of SoD governance, security rules, mitigating controls, and Firefighter/emergency access management.
• Thorough understanding of SOX ITGC controls and experience supporting internal and external audits.
• Knowledge of information security and IT risk management frameworks (e.g., NIST) and identity and access management tools and processes.
• Ability to speak to infrastructure-level security concerns and work with technical teams to address them.
• Excellent communication and stakeholder-management skills, with the ability to engage leadership, auditors, business users, and vendors.
• Strong analytical, problem-solving, and troubleshooting skills, with the ability to balance BAU support and project priorities.
• Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience.
• Experience securing SAP BTP and related cloud services (e.g., Datasphere, SAP Analytics Cloud).
• Experience with ServiceNow (or similar) integration with SAP GRC for access request management.
• Experience automating provisioning and access review processes.
• SAP Security and/or GRC training or certification.

Compensation

• Base salary range of $100,000-130,000 per year
• Bonus opportunity 15%
• 401(k) plan / group retirement savings program
• Short-term and long-term disability benefits
• Life insurance
• Health, dental, and vision insurance
• Paid time off
• Paid holidays

What CRH Offers You

• Highly competitive base pay
• Comprehensive medical, dental and disability benefits programs
• Group retirement savings program
• Health and wellness programs
• An inclusive culture that values opportunity for growth, development, and internal promotion

About CRH

CRH has a long and proud heritage. We are a collection of hundreds of family businesses, regional companies and large enterprises that together form the CRH family. CRH operates in a decentralized, diversified structure that allows you to work in a small company environment while having the career opportunities of a large international organization.

CRH Americas Building Products (ABP), a CRH Company, is an affirmative action and equal opportunity employer.

EOE/Vet/Disability CRH is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, status as a protected veteran or any other characteristic protected under applicable federal, state, or local law.