Oracle HCM SaaS Authorization / Security Lead
1 year contract – renewable based on performance
Singapore
KEY RESPONSIBILITIES
1. Strategic Leadership & Workshop Facilitation
- Lead the end-to-end Oracle HCM Security workstream, including strategy definition, planning, resource allocation, delivery governance, and stakeholder alignment.
- Facilitate and chair client workshops and working sessions to elicit business and security requirements, define authorization and access models, and align expectations across business, IT, and audit stakeholders.
- Prepare, present, and own workshop deliverables including decision logs, action trackers, access models, and security design artefacts.
- Act as the primary point of contact for all security and authorization-related matters, providing authoritative guidance to client stakeholders, functional leads, and project management teams.
2. Authorization Design & Governance
- Define, implement, and govern the Authorization Principles and Security Framework for Oracle HCM SaaS (Fusion) implementations.
- Design and enforce Role-Based Access Control (RBAC) structures, including Abstract Roles, Job Roles, Duty Roles, Data Roles, and associated data security policies.
- Establish and maintain Segregation of Duties (SoD) conflict matrices, risk classifications, and remediation frameworks in line with audit and compliance standards.
- Define and govern data security policies covering Person, Payroll, and Workforce Management data, aligned with organizational structures and business rules.
- Ensure the authorization model aligns with the client’s risk appetite, regulatory obligations, and internal governance policies.
3. Configuration, Build & Validation
- Configure and manage authorization rules, role hierarchies, and data security policies directly within Oracle HCM SaaS (Fusion).
- Conduct structured validation sessions with business users, functional consultants, and IT stakeholders to confirm access models meet business and compliance requirements.
- Perform iterative testing and refinement to address access gaps, over‑provisioning, and SoD conflicts identified during validation cycles.
- Own and govern the Oracle Security Console and related role management tools.
4. Documentation & Standards
- Author and maintain comprehensive Authorization Configuration Documentation, including role catalogues, access matrices, and data security policy registers.
- Produce and own the Security Design Document (SDD), ensuring accuracy and currency throughout the project lifecycle.
- Maintain full traceability between business requirements, security design decisions, and configured access controls.
- Define, enforce, and continuously improve documentation standards, templates, and governance across the security workstream.
5. User Access Provisioning & Audit Readiness
- Oversee and govern user access provisioning processes in line with the Joiner–Mover–Leaver (JML) framework.
- Lead role design, assignment, and rationalisation activities to ensure access is fit-for-purpose, least-privilege, and audit-ready.
- Manage access remediation initiatives including SoD conflict resolution, excessive access removal, and corrective action tracking.
- Support internal and external audits by providing evidence packs, access reports, control documentation, and audit walkthroughs.
- Define and implement Periodic Access Review (PAR) processes and ensure controls remain operational post go-live.
6. Risk, Compliance & Governance Alignment
- Ensure security configurations and controls align with applicable compliance frameworks, regulatory expectations, and internal IT governance policies.
- Partner closely with Risk, Compliance, and Internal Audit teams to validate security design against defined control objectives.
- Proactively identify, assess, and escalate security risks, gaps, and non-compliant configurations, proposing pragmatic remediation strategies.
- Contribute to and maintain the project risk register for security-related risks, ensuring mitigation actions are tracked to closure.
7. Team Leadership & Technical Mentorship
- Lead, manage, and mentor junior and mid-level security consultants, providing day-to-day technical guidance and oversight.
- Perform quality assurance reviews of security configurations, documentation, and deliverables.
- Foster a high-performance, collaborative team culture through coaching, feedback, and capability development.
- Plan and manage workstream activities, including task definition, effort estimation, and assignment in alignment with project plans.
8. Testing & Post-Go-Live Support
- Define and execute comprehensive security testing strategies for System Integration Testing (SIT) and User Acceptance Testing (UAT).
- Validate end-to-end access scenarios across all Oracle HCM modules to ensure role configurations align with business requirements.
- Triage and resolve complex access and security defects, collaborating closely with functional and technical teams.
- Support hypercare and post-go-live activities, including break-fix resolution, access queries, and security stabilization.
- Lead transition and handover of security operations to the client’s support and BAU teams.
QUALIFICATIONS & EXPERIENCE
Essential Requirements
- Minimum 10 years of hands-on experience in Oracle HCM (Fusion) Security and Authorization, including at least two full end-to-end implementations in a lead role.
- Deep expertise in Oracle HCM SaaS security architecture, including RBAC, Abstract Roles, Job Roles, Duty Roles, Data Roles, and the Oracle Security Console.
- Strong functional understanding of Oracle HCM modules including Core HR, Payroll, Talent Management, Absence Management, Workforce Management, and Recruiting.
- Proven experience defining and governing data security policies, including Person Security Profiles, Payroll Security Profiles, and Legislative Data Group (LDG) security.
- Demonstrated expertise in SoD identification, assessment, and remediation within Oracle HCM.
- Extensive experience leading client workshops, requirement gathering sessions, and design reviews.
- Strong documentation capability with experience producing SDDs, Role Catalogues, Access Matrices, and audit artefacts.
- Hands-on experience supporting SIT, UAT, and post-go-live security activities.
- Excellent stakeholder management and communication skills across business, IT, and audit functions.
- Proven experience leading and mentoring security teams in a consulting or project delivery environment.
- Desirable / Advantageous
- Oracle Cloud HCM Security certification and/or certifications in relevant functional modules.