Fully remote role
Location: San Francisco, California
Role: Staff Oracle Cloud Security & Controls Lead M&A Integrations
Duration: 6 Months
We're looking for a Staff Oracle Cloud Security & Controls Lead to own the security architecture, access governance, and controls strategy for M&A integrations, carve-outs, and legal entity onboarding. This role sets the standards for how acquired-company users get secure, compliant access to Oracle Cloud and related Finance applications. It partners with Finance, Accounting, Internal Controls, Internal Audit, IT, business process owners, and implementation teams to deliver Day 1 access with appropriate Segregation of Duties (SoD), SOX, and governance controls.
Responsibilities:
Security Architecture & Standards
- Own the Oracle Fusion security architecture and role design standards across Finance Platform, including Job, Duty, and Data Roles, privileges, and Data Security Policies.
- Set least-privilege, scalable role design principles, and decide when roles should be reused, extended, or newly created.
- Design data security across multiple ledgers, business units, and legal entities.
- Govern security for reporting (OTBI/BI Publisher) and for integration and service accounts.
- Lead security design reviews and approve role and access changes.
- Hands-on design, configuration, and troubleshooting of Oracle Fusion Job Roles, Duty Roles, Data Roles, security privileges, and Data Security Policies using Security Console and related tools.
M&A Security Strategy & Delivery
- Own the security and access workstream for acquisitions, carve-outs, and legal entity onboarding, from discovery through hypercare.
- Assess acquired-company users, job responsibilities, organizational structures, and access requirements.
- Define the Day 1 user and role mapping and access strategy across S2P, R2R, O2C, Tax, Treasury, and other Finance applications.
- Define TSA and transitional-access requirements, and coordinate provisioning and deprovisioning through organizational transitions.
- Build and maintain a reusable M&A security playbook (discovery templates, role mapping approach, Day 1 access model) that scales across acquisitions.
Controls, SoD & Access Governance
- Own the technical design, implementation, and operational effectiveness of Oracle Cloud access controls supporting SOX and ITrequirements, in partnership with Internal Controls and application control owners.
- Design, maintain, and enhance SoD rules and sensitive-access monitoring in partnership with Internal Controls.
- Perform SoD analysis, drive conflict remediation, and lead mitigating-control decisions where conflicts cannot be eliminated.
- Design access certification and role review processes.
- Partner with Internal Controls, Internal Audit, and external auditors on control design, testing, and evidence.
Identity, Provisioning & Operations
- Define provisioning architecture, including HCM-driven role provisioning rules, auto-provisioning, SSO/IdP integration, and approval workflows.
- Resolve complex provisioning, role inheritance, data access, and authorization issues.
- Own regression testing of security roles for Oracle quarterly updates.
Testing, Cutover & Production Readiness
- Own the security testing strategy across CRP, SIT, and UAT, covering role access, data access, SoD, and end-to-end business processes.
- Lead mock cutovers and production security readiness, and validate Day 1 access.
- Lead hypercare resolution and transition processes to steady-state support.
Leadership & Influence
- Provide technical leadership and guidance to consultants, security analysts, and implementation teams.
- Advise Finance, IT, and Controls leaders on access risk, trade-offs, and remediation priorities.
- Represent Oracle security and controls in architecture, program, and audit forums.
Required Qualifications
- 10+ years of Oracle application security, controls, or enterprise application experience, including 5+ years with Oracle Fusion Cloud.
- Expert knowledge of Oracle Fusion Security Console, RBAC, Job/Duty/Data Roles, privileges, and Data Security Policies.
- Track record of leading security for at least one large Oracle Fusion implementation, M&A integration, or carve-out.
- Hands-on SoD analysis, rule set design, conflict remediation, and mitigating-control experience.
- Strong working knowledge of SOX, IT and access control requirements, including experience working with auditors.
- Experience with security across Oracle Fusion Financials and/or SCM business processes.
- Experience with user provisioning architecture, HCM-driven provisioning, and security troubleshooting.
- Experience leading security testing, cutover, and production stabilization.
- Strong ability to influence cross-functional stakeholders and communicate access risk to senior leaders.
Preferred Qualifications
- Experience with Oracle Risk Management Cloud (RMC) / Advanced Access Controls, or other GRC and access governance platforms.
- Experience with SSO/IdP integration (e.g., Okta) and identity lifecycle management.
- Experience with global implementations and multi-entity, multi-ledger environments.
- Experience securing adjacent Finance applications (e.g., treasury, tax, or EPM platforms).
- Relevant certifications (e.g., Oracle Cloud Security, CISA, CISSP).
What Success Looks Like
- 100% of acquired-company users provisioned and access-validated for Day 1.
- Zero unmitigated SoD conflicts at go-live.
- No audit findings on Oracle access controls.
- No material business disruption caused by access or provisioning issues.
- An M&A security playbook and role standards adopted and reused for subsequent integrations.
