SAP Security & GRC Lead

Job ID: 529787 CRH Americas Building Products is reinventing what's possible in building solutions. We are the leading provider of innovative outdoor living products and utility infrastructure solutions for the water, energy, and communications markets throughout North America. We're a trusted and strategic partner to engineers, contractors, distributors, specifiers, retailers and homeowners alike as the manufacturer of precast concrete, polymer concrete, and plastic infrastructure products. Our portfolio of brands includes Oldcastle APG, Oldcastle Infrastructure, Belgard® hardscape, Echelon® Masonry, RDI® railing, Catalyst™ Fence Solutions, Sakrete® packaged concrete, Amerimix® mortar, Pebble Technology International® pool finishes, and Techniseal® sands and sealant technologies. Job Summary Oldcastle Infrastructure Inc. (OII) is seeking an SAP Security & GRC Lead to own the design, governance, and day-to-day operation of application security and GRC Access Control across the company's SAP landscape, including SAP S/4HANA, Fiori, SAP Business Technology Platform (BTP), and integrated SAP and non-SAP applications. This role leads a small, hands-on security team and is accountable for both business-as-usual (BAU) security support and the security workstream for new SAP rollouts and deployments. The architect partners closely with SAP functional, Basis, and development teams, Internal Audit, and Risk & Compliance to keep access secure, compliant with SOX requirements, and efficient for the business. Job Location This role is a remote role based out of Atlanta, GA. Job Responsibilities Team Leadership & Contractor Management Lead, coach, and develop direct reports, setting clear goals, priorities, and development plans. Direct the day-to-day work of contract and SI/AMS security resources, assigning work, reviewing deliverables, and holding partners accountable to SLAs and quality standards. Establish coverage models, escalation paths, and run books so BAU support and project work are both staffed appropriately. Serve as the senior technical authority for SAP security and GRC, providing guidance to SAP technical and non-technical staff. Security Architecture & GRC Governance Own the SAP security architecture and role design strategy across S/4HANA, Fiori, BTP, and integrated applications, setting standards for role design, naming, and role-to-user assignment in production and non-production systems. Establish and govern a centralized process for role administration and role design for functional (order to cash, procure to pay, record to report) and cross-functional (reporting, IT, testing) processes. Own the GRC Access Control configuration, including rulesets, segregation-of-duties (SoD) governance, mitigating controls, workflows, and approvers for provisioning, de-provisioning, and access recertification. Own Firefighter (emergency access) governance, including assignment, approval, log review, and periodic review processes. Evaluate business risks associated with role design, implement controls to address them, and recommend ways to simplify and streamline the security design. Ensure consistent identity and access strategy across SAP and non-SAP applications that integrate with SAP. BAU Security Operations Oversee daily user provisioning, role maintenance, access requests, and security incident resolution, meeting agreed service levels. Monitor, report, and remediate elevated or sensitive access in production to ensure unauthorized access is removed promptly. Approve security changes across all functional modules, ensuring alignment with organizational standards and change management processes. Identify role owners and drive automation of role and user provisioning to reduce cycle time and manual effort. Manage license compliance activities, including user counts, license type assignment, and data consolidation for license audits. New Rollouts & Project Delivery Lead the security and GRC workstream for new SAP rollouts, deployments, and enhancements, from design through go-live and hypercare. Review business blueprints and functional specifications to design security roles and authorizations for new processes, sites, and business units. Plan and oversee security role build, unit testing, and user acceptance testing, ensuring roles are assigned correctly and tested thoroughly before deployment. Plan and execute security cutover activities and provide go-live and post-go-live support. Coordinate with project managers and SI partners on scope, timelines, and resourcing for security deliverables. Audit, Compliance & Risk Ensure SOX ITGC security controls are designed, documented, operating effectively, and evidenced for internal and external audits. Serve as the primary point of contact for internal and external auditors on SAP security matters and provide audit evidence and analysis. Lead periodic user access reviews and train control owners to complete them accurately and on time. Ensure role provisioning and user access privileges comply with company security policies and SOX regulations. Stakeholder Management & Reporting Provide regular status, risk, and compliance reporting to IT leadership and program stakeholders. Partner with Basis, Development, and Infrastructure teams to ensure security is embedded across infrastructure and development practices. Conduct analysis sessions with end users and business SMEs to understand access needs and translate them into secure role designs. Job Requirements 10+ years of SAP security experience, including hands-on GRC Access Control and ECC/S/4HANA/Fiori security. 2+ years leading security teams, contractors, or SI/AMS partners in a team-lead or supervisory role. Participated in at least two SAP full-cycle implementations, rollouts, or major upgrade projects, including cutover and go-live support. Thorough understanding of the SAP authorization concept and role-based access control, with extensive experience in role design, build, and maintenance. In-depth knowledge of SoD governance, security rules, mitigating controls, and Firefighter/emergency access management. Thorough understanding of SOX ITGC controls and experience supporting internal and external audits. Knowledge of information security and IT risk management frameworks (e.g., NIST) and identity and access management tools and processes. Ability to speak to infrastructure-level security concerns and work with technical teams to address them. Excellent communication and stakeholder-management skills, with the ability to engage leadership, auditors, business users, and vendors. Strong analytical, problem-solving, and troubleshooting skills, with the ability to balance BAU support and project priorities. Bachelor's degree in Computer Science, Information Technology, or a related field, or equivalent experience. Experience securing SAP BTP and related cloud services (e.g., Datasphere, SAP Analytics Cloud). Experience with ServiceNow (or similar) integration with SAP GRC for access request management. Experience automating provisioning and access review processes. SAP Security and/or GRC training or certification. Compensation Base salary range of $100,000-130,000 per year ​​ Bonus opportunity 15% 401(k) plan​ / group retirement savings program​ Short-term and long-term disability benefits​​ Life insurance​ Health, dental, and vision insurance​ Paid time off ​ Paid holidays What CRH Offers You Highly competitive base pay Comprehensive medical, dental and disability benefits programs Group retirement savings program Health and wellness programs An inclusive culture that values opportunity for growth, development, and internal promotion About CRH CRH has a long and proud heritage. We are a collection of hundreds of family businesses, regional companies and large enterprises that together form the CRH family. CRH operates in a decentralized, diversified structure that allows you to work in a small company environment while having the career opportunities of a large international organization. If you’re up for a rewarding challenge, we invite you to take the first step and apply today! Once you click apply now, you will be brought to our official employment application. Please complete your online profile and it will be sent to the hiring manager. Our system allows you to view and track your status 24 hours a day. Thank you for your interest! CRH Americas Building Products (ABP), a CRH Company, is an Affirmative Action and Equal Opportunity Employer. EOE/Vet/Disability CRH is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, status as a protected veteran or any other characteristic protected under applicable federal, state, or local law. AI tools may be used in certain stages of the employment lifecycle, such as candidate review; however, all final employment decisions will be made by a person.