SAP Security Specialist

This role is for a SAP GRC Risk Assessment Analyst.

SAP / ERP Risk & Controls
• Risk-assessment and design of SAP controls (access management, SoD, privileged access, configuration)
• Collaborate with functional & technical teams to identify, remediate, and monitor risks in FI, MM, SD, HR (and integrated modules)
• Implement and continuously improve automated & manual controls across SAP and connected systems
• Drive sustainable SAP-audit remediation (vs. point-in-time fixes)

IT General Controls (ITGC) & Application Testing
• Plan, execute, and document ITGC testing (access, change, operations) and application-control testing across the enterprise
• Maintain testing scripts, evidence collection, and test-result sign-offs
• Ensure testing aligns with SOX, GDPR, HIPAA, and other regulatory expectations

Engineering Methodology
• Experience with standard engineering process
• Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable
• Experience with software systems design

Audit & Remediation Management
• Assist the Team with Internal Audit and external auditors (Big 4) during walkthroughs, testing, and issue resolution
• Translate audit findings into clear, risk-based remediation plans with defined owners, timelines, and success criteria
• Track remediation progress and verify effectiveness of fixes

ERP Risk Governance & Oversight
• Maintain an up-to-date ERP risk register linked to enterprise risk appetite; quantify exposure and prioritize treatment
• Design and enforce a standardized ERP control framework (design, documentation, testing methodology)
• Provide oversight, challenge, and assurance on control design and operating effectiveness

Policy, Standards & Framework Development
• Develop, maintain, and enforce ERP-specific policies, standards, and control frameworks
• Align policies with corporate GRC frameworks (nd regulatory requirements
• Conduct periodic policy reviews and updates

Stakeholder Communication & Influence
• Prepare and present risk-posture, control-effectiveness, and remediation status to senior leadership and business owners
• Translate technical risk concepts into business-impact language to influence decision-making
• Build strong relationships with IT, finance, and line-of-business partners

Technical SAP & Security Expertise
• SAP GRC (Access Control, SoD, ARA) configuration and maintenance
• SAP security administration (role design, provisioning, privileged-access management)
• Understanding of SAP ERP application controls, integration points, and data flows

ITGC Technical Knowledge
• Access control, change-management, and operations control design and testing
• Knowledge of SAP Basis impact on security (client administration, transports, patches)

Audit & Assurance Experience
• End-to-end audit engagement management (planning, fieldwork, reporting)
• Development of audit workpapers, evidence gathering, and audit-finding remediation programs
• Interaction with regulators and external auditors on compliance matters

Regulatory & Compliance Acumen
• Deep knowledge of SOX Section 404, GDPR, CCPA, ITAR, and industry-specific compliance frameworks
• Ability to map controls to regulatory requirements and produce compliance evidence

Consulting / Big-4 Experience
• Advisory mindset with ability to assess client environments, propose risk-based solutions, and drive change
• Experience delivering projects in matrixed, fast-paced environments

Communication & Presentation Skills
• Write clear policies, procedures, and risk documentation
• Deliver concise executive briefings, dashboards, and risk scorecards
• Facilitate workshops and training sessions for technical and non-technical audiences