• Job Description

  Req#: 26-00528
  This role is for a SAP GRC Risk Assessment Analyst.
  
  SAP / ERP Risk & Controls
  • Risk-assessment and design of SAP controls (access management, SoD, privileged access, configuration)
  • Collaborate with functional & technical teams to identify, remediate, and monitor risks in FI, MM, SD, HR (and integrated modules)
  • Implement and continuously improve automated & manual controls across SAP and connected systems
  • Drive sustainable SAP-audit remediation (vs. point-in-time fixes)
  
  IT General Controls (ITGC) & Application Testing
  • Plan, execute, and document ITGC testing (access, change, operations) and application-control testing across the enterprise
  • Maintain testing scripts, evidence collection, and test-result sign-offs
  • Ensure testing aligns with SOX, GDPR, HIPAA, and other regulatory expectations
  
  Engineering Methodology
  • Experience with standard engineering process
  • Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable
  • Experience with software systems design
  
  Audit & Remediation Management
  • Assist the Team with Internal Audit and external auditors (Big 4) during walkthroughs, testing, and issue resolution
  • Translate audit findings into clear, risk-based remediation plans with defined owners, timelines, and success criteria
  • Track remediation progress and verify effectiveness of fixes
  
  ERP Risk Governance & Oversight
  • Maintain an up-to-date ERP risk register linked to enterprise risk appetite; quantify exposure and prioritize treatment
  • Design and enforce a standardized ERP control framework (design, documentation, testing methodology)
  • Provide oversight, challenge, and assurance on control design and operating effectiveness
  
  Policy, Standards & Framework Development
  • Develop, maintain, and enforce ERP-specific policies, standards, and control frameworks
  • Align policies with corporate GRC frameworks (nd regulatory requirements
  • Conduct periodic policy reviews and updates
  
  Stakeholder Communication & Influence
  • Prepare and present risk-posture, control-effectiveness, and remediation status to senior leadership and business owners
  • Translate technical risk concepts into business-impact language to influence decision-making
  • Build strong relationships with IT, finance, and line-of-business partners
  
  Technical SAP & Security Expertise
  • SAP GRC (Access Control, SoD, ARA) configuration and maintenance
  • SAP security administration (role design, provisioning, privileged-access management)
  • Understanding of SAP ERP application controls, integration points, and data flows
  
  ITGC Technical Knowledge
  • Access control, change-management, and operations control design and testing
  • Knowledge of SAP Basis impact on security (client administration, transports, patches)
  
  Audit & Assurance Experience
  • End-to-end audit engagement management (planning, fieldwork, reporting)
  • Development of audit workpapers, evidence gathering, and audit-finding remediation programs
  • Interaction with regulators and external auditors on compliance matters
  
  Regulatory & Compliance Acumen
  • Deep knowledge of SOX Section 404, GDPR, CCPA, ITAR, and industry-specific compliance frameworks
  • Ability to map controls to regulatory requirements and produce compliance evidence
  
  Consulting / Big-4 Experience
  • Advisory mindset with ability to assess client environments, propose risk-based solutions, and drive change
  • Experience delivering projects in matrixed, fast-paced environments
  
  Communication & Presentation Skills
  • Write clear policies, procedures, and risk documentation
  • Deliver concise executive briefings, dashboards, and risk scorecards
  • Facilitate workshops and training sessions for technical and non-technical audiences

• About the company

  The best remote jobs for you

Notice