Single owner of user access governance, controls assurance, process audit, and continuous systems improvement across the entire application landscape. Hands-on and board-facing — equally comfortable extracting raw ERP data and presenting risk findings. We want someone dynamic and raring to make a measurable difference, not a passive reviewer.
Key Responsibilities
01 User Access Review
Reconcile all ERP/app accounts against live HR records; disable leavers and dormant users; establish JML process; maintain User Access Register with quarterly owner-certification cycles.
02 Segregation of Duties
Build role-to-function matrices; apply SoD rule library to identify conflicts (e.g. create-vendor/approve-payment); prioritise by risk; track remediation in a living Risk Register.
03 Least Privilege
Compare assigned permissions vs actual usage; produce Entitlement Heat Map; drive rationalisation programmes; establish bi-annual re-certification for all privileged accounts.
04 Access Control Vulnerabilities
Assess authentication, MFA coverage, PAM controls, API/middleware gaps, and logging adequacy; produce prioritised Vulnerability Register with risk ratings and mitigations.
05 Management Reporting & Follow-Up
Prepare risk-rated audit reports; maintain CAP tracker; conduct monthly follow-up reviews; escalate overdue critical actions; produce Quarterly Governance Dashboard for the board.