Manager ITControls and Audit Specialist, SAP and Oracle HCM

Manager ITControls and Audit Specialist, SAP and Oracle HCM
100% Remote (US)
Full-Time Opportunity Only 

About the role:

We're looking for a senior ITspecialist who knows SAP and Oracle HCM security well enough to design controls, test them and defend them in front of external auditors. You'll own IT general controls across SAP S/4HANA and Oracle Fusion HCM for SOX, run the audit cycle with internal and external audit, and fix gaps before they turn into findings.

What you'll do:

Own the ITframework:

• Own ITGCs across SAP S/4HANA and Oracle Fusion HCM for SOX 404, covering access to programs and data, program change management, computer operations and program development.
• Maintain the risk and control over Privileged Access Management (PAM) inclusive of Firefighter access in SAP and Break the Glass (BTG) access in Oracle HCM.
• Maintain the risk and control matrix (RCM), control narratives and process flows, mapped to COSO 2013 and COBIT 2019
• Cover all layers in scope for SAP: application, HANA database and operating system

Proactive (preventive) controls

• Design and maintain SoD rulesets and critical access rules in SAP GRC Access Control and Oracle Risk Management Cloud (Advanced Access Controls)
• Run SAP access provisioning through GRC ARM with SoD simulation before approval
• Own Oracle HCM role provisioning rules and data security profiles so access follows job, department and business unit
• Control privileged and emergency access using SAP Firefighter (EAM), SAP* and DDIC, and Oracle HCM IT Security Manager and administrator roles
• Govern SAP change management: SE06 and SCC4 settings, transport approvals through ChaRM or Cloud ALM
• Govern Oracle HCM quarterly updates, configuration migration and Fast Formula changes
• Restrict access to sensitive HCM data: salary, payroll, bank details, national identifiers and other PII.

Reactive (detective and corrective) controls

• Run quarterly user access reviews and role content reviews in both systems
• Review Firefighter logs, SAP Security Audit Log (SM20, RSAU_CONFIG) and table logging (SCU3)
• Monitor Oracle HCM audit policies and reports for changes to compensation, payroll elements, employee bank accounts and security setup
• Reconcile HCM terminations and transfers against SAP and Oracle access, and confirm timely removal
• Review HCM Data Loader (HDL) loads, HCM Extracts and interface failures between Oracle HCM and SAP
• Review SAP background jobs (SM37) and Oracle HCM scheduled processes for exceptions
• Lead root cause analysis and remediation when a control fails

Work with auditors

• Be the main point of contact for external auditors (Big 4) and internal audit on ITGCs
• Manage PBC lists, walkthroughs and evidence delivery for interim, year end and roll forward testing
• Support test of design and operating effectiveness, including sample selection and population completeness
• Validate IPE and key reports for completeness and accuracy
• Evaluate deficiencies (deficiency, significant deficiency, material weakness) and draft remediation plans
• Review the Oracle Cloud SOC 1 Type II report and own the related CUECs

Improve and automate

• Push continuous controls monitoring where it makes sense, cutting manual testing
• Run management self-assessments and keep control owners trained and accountable

What you bring

• 8+ years in IT audit, ITor SAP security, with Big 4 or public company SOX experience
• Hands on SAP security: roles, SUIM, SU01, PFCG, critical transactions (SE16N, SE38, SM30, SA38), RFC users
• Strong working knowledge of SAP GRC Access Control (ARA, ARM, EAM, BRM)
• Hands on Oracle Fusion HCM security: Security Console, role provisioning rules, data security profiles, audit policies
• Experience with Oracle Risk Management Cloud Advanced Access Controls or Advanced HCM Controls
• Understands how HR events drive access across systems, from hire to termination
• Proven record taking a company through clean SOX audits and remediating findings
• Can explain a control failure to an auditor, a developer and a CFO in the same day

Certifications

• CISA (required)
• CRISC, CISM or CIA
• SAP Certified Application Associate, SAP Access Control
• Oracle Risk Management Cloud Implementation Professional

Nice to have

• Healthcare, HIPAA or employee data privacy experience
• Experience with S/4HANA RISE or Oracle HCM cloud migrations from a controls perspective
• Exposure to SOC 1 and SOC 2 readiness