SAP GRC

Location:
Chennai Department: GPO Reports to: GPO – Process Owner

About The Role
We are seeking an experienced SAP GRC resource to manage and strengthen our SAP Governance, Risk, and Compliance framework. The ideal candidate will bring hands-on expertise in SAP access controls, segregation of duties (SoD) risk analysis, and IT general controls (ITGC), combined with a strong background in IT audit. This role is critical to ensuring our SAP environment is secure, compliant, and aligned with internal control and regulatory requirements.

Key Responsibilities
• Design, configure, and maintain SAP GRC Access Control, including access risk rulesets, mitigating controls, and remediation workflows.
• Perform periodic reviews of SAP user access, role assignments, privileged access, and emergency access management (Firefighter) to identify and remediate segregation of duties (SoD) conflicts.
• Review and monitor SAP access controls across key business cycles (procure-to-pay, order-to-cash, user access management) to ensure compliance with company policies and industry standards.
• Assess IT general controls (ITGC), application controls, and infrastructure controls within SAP and related environments, benchmarking against frameworks such as NIST.
• Partner with IT and Business stakeholders to investigate audit findings, track remediation progress, and drive continuous improvement in control effectiveness.
• Support external and internal audit engagements, including planning, fieldwork, reporting, and issue follow-up for SAP-based systems.
• Evaluate third-party service reports (e.g., ISAE 3402/SOC reports) for outsourced IT support functions.
• Conduct vulnerability assessments and support broader IT security reviews in collaboration with the security team.
• Develop and deliver training to key users, internal auditors, and auditees on GRC processes, tools, and controls.




• Maintain and enhance audit issue tracking systems, ensuring workflows reflect current audit practices. Required Qualifications
• Bachelor's degree in Information Systems, Computer Science, Accounting, or a related field.
• Minimum 8–12 years of combined experience in IT audit (internal and/or external) with a strong focus on SAP access controls and GRC.
• Proven hands-on experience with SAP GRC (Access Control), including access risk analysis, mitigating control assignment, and SoD rulesets.
• Working knowledge of SAP modules (MM, FI, PP, QM, PM, SD) and how they intersect with access risk.
• Solid understanding of ITGC, application controls, and vulnerability management processes.
• Experience with Identity & Access Management tools (e.g., CyberArk) and privileged access reviews.
• Familiarity with audit and data analytics tools such as ACL and TeamMate.
• Professional certification: CISA (Certified Information Systems Auditor) required; ITIL Foundation a plus.
• Experience with vulnerability assessment tools (e.g., Nmap, Nessus) is advantageous.
• Strong communication skills, with the ability to translate technical findings into actionable business recommendations.
• Proficiency in Microsoft Office (Excel, Word, Visio, PowerPoint). Preferred Attributes
• Prior exposure to Big 4 audit methodology or large-scale internal audit functions.
• Experience delivering GRC or access-control training to end users and auditors.
• Fluency in English

What We Offer
• Prospect to lead and shape the SAP GRC function within a growing organization.
• Exposure to cross-functional projects spanning IT, security, and business operations.
• Competitive compensation and professional development support

Skills:
sap pp,sap materials management (sap mm),sap qm,sap fi,cisa,itgc,grc,sap module,sap,sap sd,risk,sap grc access control,sap pm module,it audit

📌 SAP GRC Access Control Specialist – CISA Certified (Chennai)
🏢 Duobridge
📍 Chennai