Oracle HCM Security Lead - Contract

ABOUT THE ROLE

We are seeking an experienced Oracle HCM Security Lead to join a high-profile Oracle Fusion HCM implementation. In this senior role, you will own the end-to-end security and authorisation workstream - from design and configuration through to post-go-live support - working closely with client stakeholders, functional consultants, and audit teams.

This is an opportunity to shape and govern a complex, enterprise-scale security model across the full Oracle HCM suite and leave a lasting impact on the client's people systems landscape.

WHAT YOU'LL DO

1. Strategic Leadership & Workshop Facilitation

. Lead and drive the security workstream including end-to-end planning, resource allocation, and delivery governance.

. Facilitate and chair client workshops to elicit business requirements, define access models, and align stakeholder expectations.

. Prepare and present workshop outputs: decision logs, action trackers, and security design documentation.

. Serve as the primary point of contact for all authorisation and security-related queries.

2. Authorisation Design & Governance

. Define and govern the overall Authorisation Principles and Framework for the Oracle HCM SaaS implementation.

. Design and enforce RBAC structures including job roles, duty roles, abstract roles, and data security policies.

. Establish and maintain Segregation of Duties (SoD) conflict matrices and remediation frameworks.

. Define data security policies governing Person, Payroll, and Workforce Management data access.

. Ensure the authorisation model aligns with the client's risk appetite, regulatory requirements, and governance policies.

3. Configuration, Build & Validation

. Configure and build authorisation rules, role hierarchies, and data security policies in Oracle HCM SaaS (Fusion).

. Conduct structured validation exercises with business users, functional consultants, and IT stakeholders.

. Perform iterative testing and refinement to address access gaps, over-provisioning, and SoD conflicts.

. Manage and govern the Oracle Security Console and associated role management tooling.

4. Documentation & Standards

. Author and maintain comprehensive Authorisation Configuration Documentation, role catalogues, and access matrices.

. Produce and own the Security Design Document (SDD) throughout the project lifecycle.

. Maintain traceability between business requirements, design decisions, and configured rules.

5. User Access Provisioning & Audit Readiness

. Oversee user access provisioning ensuring adherence to the Joiner-Mover-Leaver (JML) framework.

. Manage access remediation: SoD conflict resolution, excessive access removal, corrective action tracking.

. Support internal and external audit activities with evidence packs, access reports, and control documentation.

. Define and implement Periodic Access Review (PAR) processes operational post go-live.

6. Risk, Compliance & Governance

. Ensure security controls align with applicable compliance frameworks and internal IT governance policies.

. Collaborate with the client's Risk, Compliance, and Internal Audit functions to validate security design.

. Identify, escalate, and track security risks and non-compliant configurations with remediation strategies.

7. Team Leadership & Mentorship

. Manage and mentor junior and mid-level security team members with technical guidance and quality oversight.

. Conduct QA reviews of security configurations, documentation, and deliverables.

. Define workstream tasks, estimate effort, and assign responsibilities in alignment with project plans.

8. Testing & Post-Go-Live Support

. Define and execute security testing strategies for SIT and UAT, including test scenario design and execution.

. Triage and resolve complex access and security defects raised during testing cycles.

. Support hypercare and post-go-live activities: break-fix resolution, access query management, and stabilisation.

. Contribute to transition and handover of security operations to the client's support function.

WHAT WE'RE LOOKING FOR

1. Essential Requirements

. 10+ years of hands-on experience in Oracle HCM (Fusion) Security and Authorisation, with at least 2 full end-to-end implementations in a lead capacity.

. Deep expertise in Oracle HCM SaaS security architecture: RBAC, Abstract Roles, Job Roles, Duty Roles, Data Roles, and Oracle Security Console.

. Strong understanding of Oracle HCM modules: Core HR, Payroll, Talent Management, Absence Management, Workforce Management, and Recruiting.

. Proven experience defining data security policies including Person Security Profiles, Payroll Security Profiles, and LDG security.

. Demonstrated expertise in SoD conflict identification, management, and remediation within Oracle HCM.

. Experience managing and facilitating client workshops, requirement sessions, and design reviews.

. Proficiency in producing high-quality security documentation: Security Design Documents, Role Catalogues, Access Matrices.

. Experience supporting SIT, UAT, and post-go-live security activities including defect triage and access validation.

. Strong stakeholder management with the ability to engage business, IT, and audit functions at all levels.

. Experience managing and mentoring security team members in a consulting or project delivery environment.

2. Desirable / Advantageous

. Oracle Cloud HCM certification in Security or relevant functional modules.

. Experience with GRC tooling for automated SoD conflict detection.

. Background in Big 4 consulting or large-scale enterprise transformation programmes.