## Role Overview Job Location Onsite Saudi
- Riyadh The Senior SAP GRC ( Process Control and Risk Management) Consultant will be responsible for the design, configuration and delivery of SAP Governance, Risk and Compliance capabilities within a large-scale SAP S/4HANA implementation and transformation program for an Aerospace & Defence (A&D;) customer. The consultant will support the establishment of an integrated governance, risk, internal control and access governance framework across the SAP landscape, covering business processes and applications including FI/CO, MM, SD, HR/HXM, EPPM, SuccessFactors Talent Suite, Manufacturing, MES, MRO, PEO, Integration and Data & Analytics. The role requires strong hands-on expertise across SAP GRC Process Control (PC) and Risk Management (RM), with the ability to translate business, audit, compliance and risk requirements into scalable SAP GRC processes and configurations. The consultant will support the complete implementation lifecycle, including requirements gathering, Fit-to-Standard workshops, control and risk design, configuration, integration, testing, cutover, go-live and hyper care. --
- ##

Key Responsibilities
### SAP GRC Solution Delivery
* Lead workshops with Risk, Compliance, Internal Audit, Finance, Security, IT and business stakeholders.
* Analyse governance, risk, internal control and access governance requirements.
* Translate business and regulatory requirements into SAP GRC AC, PC and RM solution designs.
* Configure SAP GRC capabilities in accordance with approved governance and compliance requirements.
* Support solution demonstrations, design reviews and control workshops.
* Identify process, control and access governance gaps and recommend appropriate SAP GRC solutions.
* Prepare functional design and configuration documentation.
* Manage GRC-related issues, risks, dependencies and cross-workstream requirements.
* Ensure alignment with the overall SAP S/4HANA security, control and enterprise governance architecture. Support the design and configuration of:
* Segregation of Duties (SoD) rules.
* SoD risk analysis.
* Critical access analysis.
* Critical action and permission analysis.
* User-level risk analysis.
* Role-level risk analysis.
* Risk remediation.
* Mitigation controls.
* Periodic access risk reviews.
* Compliance and audit reporting. Develop and maintain access risk frameworks across key SAP business processes. --
- ## Access Request Management (ARM) Support the design and configuration of:
* User access requests.
* Role assignment and removal.
* Access modification.
* New user provisioning.
* Approval workflows.
* Multi-level approval structures.
* Risk analysis during access requests.
* Automated provisioning, where applicable.
* Access request monitoring.
* Provisioning error handling. Ensure that access provisioning processes are efficient, auditable and aligned with the approved access governance model. --
- ## Business Role Management (BRM) Support:
* Business role design.
* Technical role governance.
* Composite and single role structures.
* Role ownership.
* Role lifecycle management.
* Role approvals.
* Role versioning.
* Role review and rationalization.
* Role documentation. Work with functional and security teams to establish a scalable role model aligned with business processes and organizational structures. --
- ## Emergency Access Management (EAM) Support the implementation of controlled emergency access processes, including:
* Firefighter user IDs.
* Emergency access workflows.
* Firefighter role design.
* Time-bound privileged access.
* Approval and authorization processes.
* Usage logging.
* Activity monitoring and review.
* Compliance reporting. --
- # SAP GRC Process Control (PC) The consultant will support the design and implementation of an enterprise internal control framework using SAP Process Control.

Key responsibilities
include: ### Control Framework Design
* Define business process and control structures.
* Configure control objectives.
* Design automated and manual controls.
* Define control owners and control performers.
* Establish control frequencies.
* Define control evidence and documentation requirements.
* Establish control testing procedures. ### Internal Control Management Support processes for:
* Internal controls over financial reporting.
* Operational controls.
* IT General Controls (ITGC), where applicable.
* Application controls.
* Automated controls.
* Manual controls.
* Compliance controls.
* Control self-assessments.
* Control testing.
* Control deficiencies and remediation. ### Continuous Control Monitoring Support, where applicable:
* Automated control monitoring.
* Exception identification.
* Control failure notifications.
* Issue management.
* Remediation tracking.
* Control effectiveness reporting. --




- # SAP GRC Risk Management (RM) The consultant will support the implementation of enterprise risk management processes using SAP Risk Management. Responsibilities include:
* Enterprise risk identification.
* Risk assessment.
* Risk categorization.
* Risk scoring.
* Likelihood and impact analysis.
* Inherent and residual risk assessment.
* Risk ownership.
* Risk response planning.
* Risk mitigation.
* Risk acceptance.
* Risk monitoring.
* Key Risk Indicator (KRI) definition and monitoring.
* Risk reporting and dashboards.
* Risk escalation workflows. Support the establishment of an integrated risk lifecycle: Risk Identification → Assessment → Evaluation → Response → Mitigation → Monitoring → Reporting --
- # Integrated AC, PC & RM Governance A key responsibility of the role is to ensure that Access Control, Process Control and Risk Management operate as an integrated governance framework. The consultant will support alignment between:
* Access risks and SoD controls.
* Business process risks.
* Internal controls.
* Enterprise risks.
* Mitigation controls.
* Control testing.
* Risk assessments.
* Issue and remediation management.
* Compliance reporting. Support the integrated governance lifecycle: Business Process → Risk Identification → Control Design → Access Governance → Control Testing → Issue Identification → Remediation → Risk Monitoring --
- # Cross-Functional GRC Coverage The consultant will work with all functional workstreams to define governance, risk and control requirements. ### FI/CO
* Financial controls.
* Journal and posting controls.
* Master data governance.
* Period-end controls.
* Payment controls.
* Financial reporting risks.
* Segregation of Duties. ### MM & Procurement
* Supplier master data controls.
* Procurement approval controls.
* Purchase order controls.
* Goods receipt and invoice controls.
* Procurement SoD risks. ### SD
* Customer master controls.
* Pricing controls.
* Sales order controls.
* Delivery and billing controls.
* Revenue-related controls. ### HR/HXM & SuccessFactors
* Employee master data controls.
* Payroll and personnel access controls.
* Organizational data controls.
* Talent and employee data governance.
* Sensitive access risks. ### EPPM / PS / CPM
* Project approvals.
* Budget controls.
* Project cost controls.
* Project change controls.
* Program governance. ### Manufacturing, PEO & MES
* Production execution controls.
* Manufacturing master data controls.
* Material consumption controls.
* Production confirmation controls.
* Quality and operational risk controls. ### MRO
* Maintenance and repair process controls.
* Spare parts and inventory controls.
* Repair and overhaul approval controls.
* Maintenance cost controls. --
- # A&D; Governance, Risk & Compliance Requirements Support governance and control requirements relevant to a complex and highly regulated A&D; environment, including:
* Strong access governance.
* Segregation of Duties.
* Controlled privileged access.
* Enterprise and operational risk management.
* Financial and operational controls.
* Program and project governance.
* Enhanced traceability.
* Auditability.
* Multi-entity governance.
* Clear accountability and ownership.
* Controlled exception and remediation processes. The consultant should be capable of balancing business enablement, security, operational effectiveness, compliance and audit requirements. --
- # Integration & Technical Collaboration Work closely with BASIS, Security, ABAP and Integration teams to support:
* GRC system integration and connectivity.
* User and role synchronization.
* Access provisioning.
* Connected system configuration.
* Automated control monitoring.
* Data extraction for risk and control reporting.
* Workflow integration.
* Technical issue resolution. Support integration with relevant SAP platforms, including:
* SAP S/4HANA.
* SAP SuccessFactors.
* SAP Fiori.
* SAP BW/BW/4HANA.
* SAP Data & Analytics platforms.
* SAP Solution Manager / ALM platforms, where applicable.
* Other SAP and enterprise applications in scope. --
- # Testing & Quality Assurance Prepare and execute GRC test scenarios covering: ### Process Control
* Control assessments.
* Control testing.
* Evidence collection.
* Control deficiencies.
* Issue remediation.
* Automated monitoring, where applicable. ### Risk Management
* Risk identification.
* Risk assessment.




* Risk scoring.
* Risk response.
* KRI monitoring.
* Risk reporting and escalation. Support:
* Unit Testing.
* System Integration Testing (SIT).
* Security and Controls Testing.
* Regression Testing.
* User Acceptance Testing (UAT). --
- # Data Migration & Content Setup Support the migration and setup of GRC-related data and content, including:
* Users and roles.
* Access risk rules.
* SoD rulesets.
* Mitigation controls.
* Business processes.
* Risks.
* Controls.
* Control owners.
* Risk owners.
* Control documentation.
* Historical issues and remediation information, where applicable. Support data validation, reconciliation and business sign-off. --
- # Cutover, Go-Live & Hypercare
* Support GRC cutover planning and execution.
* Validate PC and RM configuration readiness.
* Complete access and SoD readiness assessments.
* Validate critical controls and workflows.
* Validate emergency access processes.
* Support user and role provisioning readiness.
* Support mock cutovers.
* Participate in go/no-go readiness assessments.
* Provide functional support during go-live.
* Support issue resolution during hypercare.
* Support transition to BAU GRC, Risk and Compliance teams. --
- # Key Deliverables
* SAP GRC PC/RM Functional Design.
* Access Governance and SoD Framework.
* Access Risk Ruleset and Mitigation Framework.
* Access Request and Approval Workflow Design.
* Role Governance Framework.
* Emergency Access Management Design.
* Business Process and Control Framework.
* Risk and Control Matrix.
* Control Testing Framework.
* Enterprise Risk Management Framework.
* Risk Assessment and KRI Requirements.
* Issue and Remediation Management Process.
* GRC Integration Requirements.
* Test Scenarios and Scripts.
* Cutover and Go-Live Readiness Requirements. --
- # Required Experience
* 8–12+ years of SAP GRC and governance, risk and compliance implementation experience.
* Strong hands-on experience with SAP GRC Access Control (AC).
* Experience with SAP Process Control (PC) and SAP Risk Management (RM).
* Robust expertise in:
* Access Risk Analysis (ARA).
* Access Request Management (ARM).
* Business Role Management (BRM).
* Emergency Access Management (EAM).
* Segregation of Duties (SoD).
* Risk and Control Frameworks.
* Internal Control Management.
* Control Testing and Remediation.
* Enterprise Risk Management.
* Experience with SAP S/4HANA implementations.
* Strong understanding of SAP authorization and security concepts.
* Experience in testing, cutover, go-live and hypercare. --
- # Preferred Experience
* Experience in Aerospace & Defense or other highly regulated industries.
* Experience implementing enterprise risk and internal control frameworks.
* Experience supporting multi-entity SAP transformations.
* Experience with financial, operational and IT control frameworks.
* Experience integrating GRC with SAP SuccessFactors and other SAP applications.
* Experience with Fiori security and SAP S/4HANA authorization concepts.
* Experience supporting Internal Audit, Risk and Compliance functions.
* SAP GRC certification.
* SAP Activate methodology experience. --
- # Ideal Candidate Profile The ideal candidate is a Senior SAP GRC Consultant with strong hands-on expertise across Access Control, Process Control and Risk Management, capable of designing an integrated governance, risk and internal control framework for a complex SAP enterprise. The candidate should understand the end-to-end governance lifecycle: Business Process → Risk Identification → Control Design → Access Governance → Control Execution → Testing → Issue Management → Remediation → Risk Monitoring They should understand governance dependencies across: GRC AC/PC/RM → S/4HANA → FI/CO → MM → SD → HR/HXM → EPPM → Manufacturing → PEO → MES → MRO → SuccessFactors → Integration → Data & Analytics The consultant should be comfortable working within a large transformation environment involving the Business Integrator (BI), System Integrator (SI) and Transformation Management Office (TMO) and collaborating with Risk, Compliance, Internal Audit, Security, Finance, Functional and Technical stakeholders. ### Success Measure The Senior SAP GRC (PC/RM) Consultant will be successful when the SAP GRC solution is effectively designed, configured, integrated, tested and deployed, enabling a robust enterprise framework for access governance, internal controls and risk management. Success will be demonstrated through effective SoD management, controlled access provisioning, strong internal control monitoring, structured risk management, timely issue remediation and improved auditability and compliance across all entities and business processes in scope. Skills SAP Governance Risk Complaince Acceptance criteria
• Senior SAP GRC (PC/RM) consultant

📌 SAP Consultant (Chennai)
🏢 KaarTech
📍 Chennai