Xylem is a Fortune 500 global water solutions company dedicated to advancing sustainable impact and empowering the people who make water work every day. As a leading water technology company with 23000 employees operating in over 150 countries Xylem is at the forefront of addressing the worlds most critical water challenges. We invite passionate individuals to join our team dedicated to exceeding customer expectations through innovative and sustainable solutions.

Access control architecture and role design

Own the global SAP role design strategy and architecture business role catalog derivation strategy naming

standards and the design principles that keep roles maintainable as segments and waves are added.

Design and maintain the segregation of duties ruleset aligned to business process risk and validated with

internal audit external audit and process owners rather than accepted as a vendor default.

Own risk analysis mitigation control design and the remediation roadmap for SoD conflicts across the

landscape including the standing view of accepted risk and who accepted it.

Establish role lifecycle management: change control testing approval and periodic recertification with

business role ownership that is named and accountable.

SAP GRC solution ownership

Own SAP GRC design configuration and operations across Access Control Access Risk Analysis

Emergency Access Management Business Role Management and Access Request Management and

Process Control where applicable.

Operate GRC as a product with a backlog and release cadence: ruleset maintenance workflow design

connector management and continuous improvement.

Own Emergency Access Management end to end firefighter provisioning model allocation approach

activity logging and log review discipline enforced within required windows. Where review timeliness has

slipped in the past you own the design change that makes it structurally difficult to slip again

Ensure any provisioning path that operates outside GRC cutover accounts data load IDs technical users

is deliberately designed time-bound monitored and formally closed never left as an undocumented

residue after go-live.

Own user provisioning and deprovisioning integration with identity management joiner-mover-leaver

processes and HR-driven access lifecycle.

Audit and compliance governance

Own SOX IT general controls and application controls for the SAP landscape: access to programs and data

program change program development and computer operations.

Serve as primary interface to internal audit external audit and control owners evidence provision

walkthrough support deficiency response and remediation tracking to closure.

Design controls so evidence is generated as a byproduct of the system operating correctly rather than





assembled manually at audit time.

Maintain continuous control monitoring across access configuration and financial process controls with

exceptions routed to owners for action.

Own the compliance framework for data privacy and regulatory requirements as they apply to SAP data across

regions.

Deployment wave and program integration

Provide GRC and controls readiness as a formal go-live gate for every deployment wave: role build SoD

analysis mitigating controls in place and clean provisioning before cutover.

Partner with the ABAP and BTP team on SoD-safe development standards custom transaction and Fiori app

risk classification and authorization object design.

Partner with the Basis Leader on technical security operations privileged access and audit logging.

Partner with process owners and the Data Conversion and MDG leads so control design reflects the actual

process design not an idealized version of it.

Lead a global team of GRC and security consultants across onshore and offshore and hold AMS and system

integrator partners accountable for role quality and control adherence.

Qualifications

Required

15 years in SAP security and GRC with at least 5 years in a solution architect or global leadership capacity.

Deep hands-on SAP GRC Access Control expertise ARA EAM BRM ARM including ruleset design

workflow configuration and connector architecture in production.

Expert-level S/4HANA authorization design: authorization objects Fiori catalogs groups and spaces business

roles and the differences from classical ECC role design.

Proven ownership of SoD ruleset design and remediation on a global program with demonstrated conflict

reduction rather than documented conflict.

Strong SOX ITGC and application control experience in a publicly listed environment with direct external audit

engagement.

Demonstrated design of controls that are automated and continuously evidenced not dependent on manual

periodic execution.

Experience delivering security and controls through multi-wave global S/4HANA deployments including cutover and hypercare.

Ability to hold a control position under delivery pressure the credibility to explain to a program leader why an

exception costs more than the delay.

Preferred

SAP Identity Management IAG or third-party IAM integration (SailPoint Saviynt Okta).





SAP Process Control Risk Management or continuous control monitoring platforms.

RISE with SAP security and shared responsibility model experience.

BTP security architecture identity propagation and authorization models.

CISA CISM CRISC or SAP security certification.

Manufacturing or industrial sector control environment including plant-level and trade compliance

considerations.

Success in the First 12 Months

A rationalized global role model with named business role owners and a validated SoD ruleset. Firefighter usage

under a controlled model with log reviews completed inside required windows evidenced automatically. All

non-GRC provisioning paths inventoried time-bound and closed. Controls readiness established as a

non-negotiable go-live gate. Audit findings and deficiencies closed on schedule with a measurable reduction in

repeat findings. And a control environment where evidence is produced by the system rather than assembled by

people.

Operating Principles You Will Work Under

Products not projects. Persistent teams aligned to value streams funded by capacity rather than project

cycles each paired with a business process owner accountable for the outcome.

Clean core is non-negotiable. Extensions live on BTP the core stays standard and custom code is governed at the point of creation.

Paved road not toll booth. Golden paths reference architectures and reusable patterns with guardrails

enforced in the pipeline rather than in a design authority meeting.

Compliance by default. Controls are designed into the platform and evidenced automatically so control

integrity holds at deployment scale.

Accountable for value not volume. Success is measured in business process KPIs adoption and realized

value not tickets closed or hours delivered.

Intelligent enterprise by design. AI and agent enablement and the data readiness that makes both credible

are owned capabilities.

Global template authority local execution. Template integrity is held centrally through the current

deployment horizon with a defined path to greater product-team autonomy.

Join the global Xylem team to be a part of cutting-edge technology solutions transforming water usage conservation and re-use. Our products impact public utilities industrial sectors residential areas and commercial buildings with a commitment to providing smart metering network technologies and advanced analytics for water electric and gas utilities. Partner with us in creating a world where water challenges are met with ingenuity and dedication; where we recognize the power of inclusion and belonging in driving innovation and allowing us to compete more effectively around the world.

Required Experience:

Senior Manager

📌 Senior Manager — SAP GRC Solution Architect, Audit & Compliance Governance (Bengaluru)
🏢 Xylem
📍 Bengaluru