Job Description

SAP GRC Risk Assessment Analyst

SAP / ERP Risk & Controls

Risk-assessment and design of SAP controls (access management, SoD, privileged access, configuration)

Collaborate with functional & technical teams to identify, remediate, and monitor risks in FI, MM, SD, HR (and integrated modules)

Implement and continuously improve automated & manual controls across SAP and connected systems

Drive sustainable SAP-audit remediation (vs. point-in-time fixes)

IT General Controls (ITGC) & Application Testing

Plan, execute, and document ITGC testing (access, change, operations) and application-control testing across the enterprise

Maintain testing scripts, evidence collection, and test-result sign-offs

Ensure testing aligns with SOX, GDPR, HIPAA, and other regulatory expectations

Engineering Methodology

Experience with standard engineering process

Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable

Experience with software systems design

Audit & Remediation Management

Assist the Team with Internal Audit and external auditors (Big 4) during walkthroughs, testing, and issue resolution

Translate audit findings into clear, risk-based remediation plans with defined owners, timelines, and success criteria

Track remediation progress and verify effectiveness of fixes

ERP Risk Governance & Oversight

Maintain an up-to-date ERP risk register linked to enterprise risk appetite; quantify exposure and prioritize treatment

Design and enforce a standardized ERP control framework (design, documentation, testing methodology)

Provide oversight, challenge, and assurance on control design and operating effectiveness

Policy, Standards & Framework Development

Develop, maintain, and enforce ERP-specific policies, standards, and control frameworks

Align policies with corporate GRC frameworks (nd regulatory requirements

Conduct periodic policy reviews and updates

Stakeholder Communication & Influence

Prepare and present risk-posture, control-effectiveness, and remediation status to senior leadership and business owners

Translate technical risk concepts into business-impact language to influence decision-making

Build strong relationships with IT, finance, and line-of-business partners

Technical SAP & Security Expertise

SAP GRC (Access Control, SoD, ARA) configuration and maintenance

SAP security administration (role design, provisioning, privileged-access management)

Understanding of SAP ERP application controls, integration points, and data flows

ITGC Technical Knowledge

Access control, change-management, and operations control design and testing

Knowledge of SAP Basis impact on security (client administration, transports, patches)

Audit & Assurance Experience

End-to-end audit engagement management (planning, fieldwork, reporting)

Development of audit workpapers, evidence gathering, and audit-finding remediation programs

Interaction with regulators and external auditors on compliance matters

Regulatory & Compliance Acumen

Deep knowledge of SOX Section 404, GDPR, CCPA, ITAR, and industry-specific compliance frameworks

Ability to map controls to regulatory requirements and produce compliance evidence

Consulting / Big-4 Experience

Advisory mindset with ability to assess client environments, propose risk-based solutions, and drive change

Experience delivering projects in matrixed, fast-paced environments

Communication & Presentation Skills

Write clear policies, procedures, and risk documentation

Deliver concise executive briefings, dashboards, and risk scorecards

Facilitate workshops and training sessions for technical and non-technical audiences

Job Tags

Similar Jobs