Sr. Manager, IT Security & Risk

Oceaneering•Houston, TX

15h

About The Position

The Senior Manager, Security & Controls leads the day-to-day delivery and strategic advancement of Security & Controls for Oracle Fusion Cloud ERP and Costpoint ERP. Reporting to the Sr. Director – Enterprise Applications, this role is accountable for application security, user access governance, segregation of duties, controls design and testing, compliance, audit support, service levels, staffing, reporting, and continuous improvement. The position builds and operates a sustainable, risk-based capability that protects enterprise applications while enabling efficient business operations. The role oversees end-to-end Security & Controls service delivery, including provisioning, access reviews, controls testing, incident and request resolution, audit support, reporting, team capacity and budget, and continuity coverage. It establishes application security governance and standards, including role design, least privilege, privileged access, sensitive access, and segregation-of-duties rules. It leads automation and continuous improvement, assesses ERP changes for security and controls impacts, and serves as the senior point of contact for internal and external auditors. The position also governs access-driven license and consumption demand, leads and develops the Security & Controls team, and builds relationships with business and technology stakeholders. It translates technical security and controls issues into business risks, impacts, options, and recommendations for leadership. This is an office-work position, with occasional travel and work outside normal business hours to support audits, releases, incidents, or global operations.

Requirements

Bachelor’s degree in Management Information Systems, Computer Science, Accounting, Finance, Cybersecurity, or a related discipline.
At least 7 years of experience in ERP application security, controls, access governance, audit, implementation, or managed services, including at least 3 years in a leadership capacity.
At least 5 years of experience with Oracle Fusion Cloud ERP security and controls, including role design, access provisioning, segregation of duties, sensitive access, and controls evidence.
At least 5 years of experience presenting control design, risk, evidence, remediation, and findings to internal and external auditors and senior stakeholders.
Strong written, verbal, analytical, problem-solving, and executive communication skills.
Must be a U.S. citizen or U.S. permanent resident.
Broad knowledge of ERP security, access governance, segregation of duties, internal controls, audit practices, and technology risk management.
Ability to balance control effectiveness, user experience, operational efficiency, regulatory needs, and business risk.
Ability to establish governance, standards, metrics, service levels, operating procedures, and sustainable accountability.
Ability to manage multiple priorities, resolve escalations, and communicate decisions in a complex, global, matrixed environment.
Ability to build credibility and influence across technical, functional, audit, compliance, and executive stakeholder groups.
Commitment to confidentiality, professional judgment, ethical conduct, and a respectful workplace culture.

Nice To Haves

Oracle Risk Management Cloud experience, including Advanced Access Controls, Advanced Financial Controls, and Access Certification.
Experience managing Security & Controls for Costpoint ERP or leading Security & Controls across multiple regulated or financially significant ERP platforms.
Experience leading end-to-end ERP security implementations through design, build, test, deployment, stabilization, and sustainment.
Identity governance, privileged access management, self-service access request, or approval workflow implementation experience.
Controls automation, continuous monitoring, automated testing, analytics, and evidence management experience.
Professional certification such as CISA, CISM, CISSP, CIA, CPA, or an Oracle Cloud certification.
Experience supporting government contracting, aerospace and defense, or other regulated operating environments.
Managed service or shared service operating model experience across multiple geographic locations and time zones.

Responsibilities

Own end-to-end delivery of Security & Controls across Oracle Fusion Cloud ERP and Costpoint ERP, including provisioning, access reviews, controls testing, incident and request resolution, audit support, and reporting.
Define, publish, monitor, and improve service levels and performance measures for access requests, security incidents, controls execution, and audit support.
Manage the Security & Controls operating model, capacity plan, staffing mix, budget, priorities, risks, and delivery commitments.
Maintain documented procedures, runbooks, escalation paths, cross-training, and business continuity coverage for critical services.
Set application security architecture and governance direction, including role design, least privilege, privileged access, and segregation-of-duties standards.
Govern role catalogs, personas, job-to-role mappings, approval workflows, sensitive access, and periodic user access certifications.
Own segregation-of-duties and sensitive-access rulesets, risk ratings, mitigating controls, exception processes, and periodic reviews.
Direct security remediation and role redesign, including resolution of inherited, custom, and cross-application access conflicts.
Partner with Identity and Access Management, Cybersecurity, infrastructure, integration, functional, and business teams on joiner, mover, and leaver controls.
Lead automation of access requests, approvals, segregation-of-duties checks, access certifications, controls testing, monitoring, evidence generation, and reporting.
Advance controls toward continuous, evidence-generating approaches where practical and risk appropriate.
Maintain a prioritized Security & Controls roadmap with measurable improvements in effectiveness, cycle time, quality, coverage, and effort.
Assess ERP releases, enhancements, integrations, and configuration changes for security and controls impacts before production deployment.
Serve as the senior Security & Controls point of contact for internal and external auditors for application security and controls.
Coordinate control walkthroughs, evidence, testing support, issue responses, and remediation through closure.
Ensure control evidence is complete, accurate, timely, traceable, and retained in accordance with applicable requirements.
Escalate residual risks with documented business impact, compensating controls, risk acceptance, accountable ownership, and target dates.
Maintain alignment with financial reporting, contractual, regulatory, cybersecurity, and internal control requirements.
Maintain an evidenced view of access-driven license and consumption demand across supported ERP platforms.
Govern dormant account reviews, unnecessary access removal, role rationalization, and license impacts of security design decisions.
Partner with Procurement, Finance, and application owners on renewals, true-ups, audits, and optimization opportunities.
Recruit, lead, develop, and retain the Security & Controls team; establish objectives, accountability, succession plans, and development priorities.
Coach managers and team leads and build capability across Oracle Fusion Cloud ERP, Costpoint ERP, controls, audit, and access governance.
Build trusted relationships with business process owners and stakeholders across Finance, HR, Supply Chain, Government/Defense, Internal Audit, external audit, Cybersecurity, Compliance, Legal, and IT.
Translate technical security and controls issues into clear business risks, impacts, options, and recommended leadership decisions.
Supervise Security & Controls personnel and potentially oversee employees, contractors, and managed service resources.