Sr. Manager, IT Security & Risk

Overview

Oceaneering’s Enterprise Applications organization enables secure, reliable, and compliant business operations through enterprise platforms, governance, and support. The Security & Controls function partners with business process owners, Internal Audit, external auditors, Cybersecurity, Compliance, and IT delivery teams to manage application security, access governance, segregation of duties, controls, and audit readiness across the ERP landscape.

Position Summary

The Senior Manager, Security & Controls leads the day-to-day delivery and strategic advancement of Security & Controls for Oracle Fusion Cloud ERP and Costpoint ERP. Reporting to the Sr. Director – Enterprise Applications, this role is accountable for application security, user access governance, segregation of duties, controls design and testing, compliance, audit support, service levels, staffing, reporting, and continuous improvement. The position will build and operate a sustainable, risk-based S&C capability that protects Oceaneering’s enterprise applications while enabling efficient business operations.

Duties and Responsibilities

Operational Leadership and Service Delivery

- Own end-to-end delivery of the Security & Controls function across Oracle Fusion Cloud ERP and Costpoint ERP, including provisioning, access reviews, controls testing, incident and request resolution, audit support, and reporting.
- Define, publish, monitor, and continuously improve service levels and performance measures for access requests, security incidents, controls execution, and audit support.
- Manage the operating model, capacity plan, staffing mix, budget, priorities, risks, and delivery commitments for the S&C team.
- Ensure documented procedures, runbooks, escalation paths, cross-training, and business continuity coverage are maintained for critical S&C services.

Application Security and Access Governance

- Set direction for application security architecture and governance across Oracle Fusion Cloud ERP and Costpoint ERP, including role design, least privilege, privileged access, and segregation-of-duties standards.
- Govern role catalogs, personas, job-to-role mappings, approval workflows, sensitive access, and periodic user access certifications.
- Own segregation-of-duties and sensitive-access rulesets, risk ratings, mitigating controls, exception processes, and periodic reviews.
- Direct security remediation and role redesign activities, including resolution of inherited, custom, and cross-application access conflicts.
- Partner with Identity and Access Management, Cybersecurity, infrastructure, integration, functional, and business teams to ensure consistent joiner, mover, and leaver controls.

Controls, Automation, and Continuous Improvement

- Lead automation of access requests, approvals, segregation-of-duties checks, access certifications, controls testing, monitoring, evidence generation, and reporting.
- Advance the function from periodic and manual controls toward continuous, evidence-generating controls where practical and risk appropriate.
- Maintain a prioritized S&C roadmap with measurable improvements in control effectiveness, cycle time, quality, coverage, and effort.
- Assess ERP releases, enhancements, integrations, and configuration changes for security and controls impacts before production deployment.

Compliance, Audit, and Risk Management

- Serve as the senior S&C point of contact for internal and external auditors for Oracle Fusion Cloud ERP and Costpoint ERP application security and controls.
- Coordinate control walkthroughs, evidence, testing support, issue responses, and remediation through closure.
- Ensure control evidence is complete, accurate, timely, traceable, and retained in accordance with applicable requirements.
- Escalate residual risks with documented business impact, compensating controls, risk acceptance, accountable ownership, and target dates.
- Maintain alignment with applicable financial reporting, contractual, regulatory, cybersecurity, and internal control requirements.

License and Consumption Governance

- Maintain an evidenced view of access-driven license and consumption demand across supported ERP platforms.
- Govern dormant account reviews, unnecessary access removal, role rationalization, and the license impact of security design decisions.
- Partner with Procurement, Finance, and application owners to support renewals, true-ups, audits, and optimization opportunities.

People and Stakeholder Leadership

- Recruit, lead, develop, and retain a high-performing S&C team; establish objectives, accountability, succession plans, and development priorities.
- Coach managers and team leads while building broader capability across Oracle Fusion Cloud ERP, Costpoint ERP, controls, audit, and access governance.
- Build trusted relationships with business process owners, Finance, HR, Supply Chain, Government/Defense stakeholders, Internal Audit, external auditors, Cybersecurity, Compliance, Legal, and IT leaders.
- Translate technical security and controls issues into clear business risk, impact, options, and recommended decisions for leadership.

Qualifications

REQUIRED

- Bachelor’s degree in Management Information Systems, Computer Science, Accounting, Finance, Cybersecurity, or a related discipline.
- 7+ years of experience in ERP application security, controls, access governance, audit, implementation, or managed services, including at least three years in a leadership capacity.
- Minimum 5 years of experience with Oracle Fusion Cloud ERP security and controls, including role design, access provisioning, segregation of duties, sensitive access, and controls evidence.
- Minimum 5 years of e xperience presenting control design, risk, evidence, remediation, and findings to internal and external auditors and senior stakeholders.
- Strong written, verbal, analytical, problem-solving, and executive communication skills.
- Must be a U.S. citizen or U.S. permanent resident.

DESIRED

- Oracle Risk Management Cloud experience, including Advanced Access Controls, Advanced Financial Controls, and Access Certification.
- Experience managing security and controls for Costpoint ERP or demonstrated experience leading S&C across multiple regulated or financially significant ERP platforms.
- Experience leading end-to-end ERP security implementations through design, build, test, deployment, stabilization, and sustainment.
- Identity governance, privileged access management, self-service access request, or approval workflow implementation experience.
- Controls automation, continuous monitoring, automated testing, analytics, and evidence management experience.
- Professional certification such as CISA, CISM, CISSP, CIA, CPA, or an Oracle Cloud certification.
- Experience supporting government contracting, aerospace and defense, or other regulated operating environments.
- Managed service or shared service operating model experience across multiple geographic locations and time zones.

Knowledge, Skills, Abilities, and Other Characteristics

- Broad knowledge of ERP security, access governance, segregation of duties, internal controls, audit practices, and technology risk management.
- Ability to balance control effectiveness, user experience, operational efficiency, regulatory needs, and business risk.
- Ability to establish governance, standards, metrics, service levels, operating procedures, and sustainable accountability.
- Ability to manage multiple priorities, resolve escalations, and communicate decisions in a complex, global, matrixed environment.
- Ability to build credibility and influence across technical, functional, audit, compliance, and executive stakeholder groups.
- Commitment to confidentiality, professional judgment, ethical conduct, and a respectful workplace culture.

Working Conditions

This position is considered OFFICE WORK and is characterized as follows:

- Almost exclusively indoors during the day and occasionally at night.
- Occasional exposure to airborne dust in the workplace.
- Work surface is stable and flat.
- May require occasional travel and work outside normal business hours to support audits, releases, incidents, or global operations.

Physical Activity/Requirements

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

This position is considered LIGHT work.

OCCASIONAL

FREQUENT

CONSTANT

Lift up to 20 pounds
Climbing, stooping, kneeling, squatting, and reaching

Lift up to 10 pounds
Standing

Repetitive movements of arms and hands
Sit with back supported