Information Security Engineer

Hollstadt Overview

Hollstadt Consulting is a management and technology consulting firm dedicated to placing professionals at engagements where they will excel. When you work with us, you'll work with a refreshingly real company led and staffed by seasoned experts who are also down-to-earth, good people. We're committed to treating you with respect and helping you achieve your career aspirations.

Since 1990, Hollstadt has been a trusted partner to more than 150 domestic and global companies and has successfully completed over 3,000 projects. Our continued growth has created challenging and rewarding opportunities for accomplished IT and Business Consultants. Hollstadt Consulting is an equal opportunity employer including disability/veteran.

By applying for this job, you agree to receive calls, AI-generated calls, text messages, or emails from Hollstadt Consulting and its affiliates, and contracted partners. Frequency varies for text messages. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages. You can reply STOP to cancel at any time.

Role: Information Security Engineer

Duration: ASAP - 7/31/2027

Location: Remote

Rate: $56.15-$62.06/hour W2, dependent on skills and qualifications

Description of work / project:

The client is seeking an Information Security Engineer with Oracle security expertise to implement, configure, and operationalize security controls for the migration from Oracle E-Business Suite (EBS) to Oracle Fusion Cloud, supported by Oracle Cloud Infrastructure (OCI) and PaaS services such as Oracle Integration Cloud (OIC) and Visual Builder Cloud Service (VBCS).

This role is responsible for executing and validating security implementations across Oracle platforms, including RBAC configuration, Segregation of Duties (SoD) enforcement, system hardening, identity integration (SSO/MFA), and monitoring. The Engineer works closely with architects, implementation partners, and business teams to ensure controls are deployed correctly, tested thoroughly, and audit-ready at go-live and beyond.

Key Responsibilities

1) Security Implementation & Configuration

• Implement security controls across Oracle Fusion, OCI, and PaaS (OIC, VBCS) environments.
• Configure:
  • Fusion roles, privileges, and data security policies
  • OCI IAM users, groups, compartments, and policies
  • PaaS security settings and service configurations
• Translate architectural designs into working, enforceable controls.
• Troubleshoot and resolve security configuration issues and defects during build and testing.

2) Access Model Deployment (RBAC / SoD / SA)

• Execute and configure:
  • RBAC models aligned to job roles and least privilege
  • SoD and Sensitive Access (SA) rules within Oracle and supporting tools
• Support and facilitate:
  • Role build, configuration, and iterative refinement
  • System Integration Testing (SIT) and User Acceptance Testing (UAT)
• Perform:
  • Access validation and conflict testing (positive/negative scenarios)
  • Remediation of SoD conflicts in coordination with business owners
• Assist in maintaining accurate and audit-ready role and access documentation.

3) Automated Controls Implementation & Testing

• Configure automated business process controls (ABPC) within Oracle Fusion.
• Execute:
  • Control testing and validation of effectiveness
  • Audit policy configuration for high-risk transactions
• Implement compensating controls where automation is not feasible:
  • Document procedures and evidence requirements
  • Support control owners in execution and validation

4) Identity Integration (SSO / MFA) Implementation

• Configure and validate identity integration across:
  • Oracle Fusion
  • OCI and OIC
• Implement:
  • Federation with enterprise identity provider
  • SSO and MFA enforcement policies
  • Conditional access and session controls
• Configure and test:
  • Break-glass/emergency access accounts
  • Authentication logging and traceability
• Support end-to-end identity testing across environments.

5) OCI & PaaS Security Hardening

• Implement OCI security configurations, including:
  • IAM policies, dynamic groups, and least-privilege access
  • Environment segregation (Dev/Test/Pre-Prod/Prod)
• Configure network security controls:
  • Security lists, private endpoints, service gateways
  • Firewall rules and egress restrictions
• Deploy and tune:
  • OCI Web Application Firewall (WAF)
• Implement platform hardening:
  • CIS-aligned configurations
  • Vault/key management and secrets protection
  • Secure object storage settings
• Enable logging and monitoring:
  • OCI audit logs, WAF logs, and service telemetry
  • Integration with enterprise SIEM and alerting pipelines

6) Integration Security Implementation (OIC & Third-Party)

• Configure security for integrations across OIC, Fusion, OCI, and external systems.
• Implement:
  • API authentication and authorization mechanisms
  • Secure credential storage (vaults/secrets management)
  • Encryption of data in transit and message integrity controls
• Enforce:
  • Least-privilege access for integration accounts
  • Separation of duties across service accounts
• Configure:
  • Secure endpoints (private endpoints, API gateways where applicable)
• Enable monitoring:
  • Logging of API calls and integration events
  • SIEM ingestion and alerting for anomalies
• Maintain integration security documentation and evidence artifacts.

7) Testing & Validation

• Execute security testing across all environments, including:
  • Access validation and role-based testing
  • SoD conflict validation
  • Control effectiveness testing
• Identify and remediate:
  • Security defects, misconfigurations, and control gaps

Performance expectations: 

Success Measures

• Security controls successfully implemented and functioning across Oracle environments
• RBAC and SoD models enforced with minimal access defects in testing and production
• SSO/MFA fully operational across Fusion, OCI, OIC, and VBCS
• OCI and PaaS environments hardened and aligned to security baselines
• Automated and manual controls tested, evidenced, and audit-ready
• Security issues identified and resolved early through testing cycles