Fully Remote Role :: Oracle Cloud Security & Controls Lead - M&A Integrations

Security Architecture & Standards

• Own the Oracle Fusion security architecture and role design standards across Finance Platform, including Job, Duty, and Data Roles, privileges, and Data Security Policies.
• Set least-privilege, scalable role design principles, and decide when roles should be reused, extended, or newly created.
• Design data security across multiple ledgers, business units, and legal entities.
• Govern security for reporting (OTBI/BI Publisher) and for integration and service accounts.
• Lead security design reviews and approve role and access changes.
• Hands-on design, configuration, and troubleshooting of Oracle Fusion Job Roles, Duty Roles, Data Roles, security privileges, and Data Security Policies using Security Console and related tools.

M&A Security Strategy & Delivery

• Own the security and access workstream for acquisitions, carve-outs, and legal entity onboarding, from discovery through hypercare.
• Assess acquired-company users, job responsibilities, organizational structures, and access requirements.
• Define the Day 1 user and role mapping and access strategy across S2P, R2R, O2C, Tax, Treasury, and other Finance applications.
• Define TSA and transitional-access requirements, and coordinate provisioning and deprovisioning through organizational transitions.
• Build and maintain a reusable M&A security playbook (discovery templates, role mapping approach, Day 1 access model) that scales across acquisitions.

Controls, SoD & Access Governance

• Own the technical design, implementation, and operational effectiveness of Oracle Cloud access controls supporting SOX and ITrequirements, in partnership with Internal Controls and application control owners.
• Design, maintain, and enhance SoD rules and sensitive-access monitoring in partnership with Internal Controls.
• Perform SoD analysis, drive conflict remediation, and lead mitigating-control decisions where conflicts cannot be eliminated.
• Design access certification and role review processes.
• Partner with Internal Controls, Internal Audit, and external auditors on control design, testing, and evidence.

Identity, Provisioning & Operations

• Define provisioning architecture, including HCM-driven role provisioning rules, auto-provisioning, SSO/IdP integration, and approval workflows.
• Resolve complex provisioning, role inheritance, data access, and authorization issues.
• Own regression testing of security roles for Oracle quarterly updates.

Testing, Cutover & Production Readiness

• Own the security testing strategy across CRP, SIT, and UAT, covering role access, data access, SoD, and end-to-end business processes.
• Lead mock cutovers and production security readiness, and validate Day 1 access.
• Lead hypercare resolution and transition processes to steady-state support.

Leadership & Influence

• Provide technical leadership and guidance to consultants, security analysts, and implementation teams.
• Advise Finance, IT, and Controls leaders on access risk, trade-offs, and remediation priorities.
• Represent Oracle security and controls in architecture, program, and audit forums.

• 10+ years of Oracle application security, controls, or enterprise application experience, including 5+ years with Oracle Fusion Cloud.
• Expert knowledge of Oracle Fusion Security Console, RBAC, Job/Duty/Data Roles, privileges, and Data Security Policies.
• Track record of leading security for at least one large Oracle Fusion implementation, M&A integration, or carve-out.
• Hands-on SoD analysis, rule set design, conflict remediation, and mitigating-control experience.
• Strong working knowledge of SOX, IT and access control requirements, including experience working with auditors.
• Experience with security across Oracle Fusion Financials and/or SCM business processes.
• Experience with user provisioning architecture, HCM-driven provisioning, and security troubleshooting.
• Experience leading security testing, cutover, and production stabilization.
• Strong ability to influence cross-functional stakeholders and communicate access risk to senior leaders., * Experience with Oracle Risk Management Cloud (RMC) / Advanced Access Controls, or other GRC and access governance platforms.
• Experience with SSO/IdP integration (e.g., Okta) and identity lifecycle management.
• Experience with global implementations and multi-entity, multi-ledger environments.
• Experience securing adjacent Finance applications (e.g., treasury, tax, or EPM platforms).
• Relevant certifications (e.g., Oracle Cloud Security, CISA, CISSP).

What Success Looks Like

• 100% of acquired-company users provisioned and access-validated for Day 1.
• Zero unmitigated SoD conflicts at go-live.
• No audit findings on Oracle access controls.
• No material business disruption caused by access or provisioning issues.
• An M&A security playbook and role standards adopted and reused for subsequent integrations.