User Access Management - SAP GRC Access Control Analyst

Job Summary

Role Purpose: The purpose of the role is to support user access security and compliance across global SAP S4 systems, while driving strategic User Access Management initiatives to support organizational growth and technological for business adaptation purposes.

JJ Innovative Medicine (IM) Transcend is a global, multi-year end-to-end business transformation program aimed at modernizing foundational business processes through the implementation of SAP S/4 HANA. This program focuses on core functionalities related to SAP Manufacturing, Order to Cash, Procure to Pay, and Finance processes. The IMUAM team plays a crucial role in ensuring security requirements are designed and implemented compliantly within this program.

The GRC governance analyst will work with the UAM Governance Lead to establish and ensure a robust SAP GRC Access Control, SoD risk management, and ruleset governance framework, emphasizing accurate execution of risk analysis across role and cross-system levels, effective mitigation and ruleset updates, and comprehensive documentation and reporting practices that ensure clarity, consistency, compliance, and audit readiness.

Key Responsibilities

• Implement and support SAP GRC Access Control solutions, ensuring effective user access governance
• Perform Segregation of Duties (SoD) risk analysis across:
  • Single role level
  • Composite/persona role level
  • Cross-system environments (where applicable)
• Propose and implement ruleset updates to eliminate inherent risks
• Update and maintain the mitigating control library
• Produce and validate risk analysis reports using SAP GRC and supporting tools (e.g., Alteryx), ensuring data accuracy and audit readiness.
• Manage the end-to-end GRC ruleset lifecycle:
  • Intake, assessment, and prioritization of changes
  • Consolidation of change requests (e.g., audit recommendations, new tcodes, false positives/negatives)
• Coordinate with key stakeholders including GRC CoE, SAP Security, Solution Delivery, and Compliance to align on ruleset updates and risk decisions.
• Ensure proper version control, documentation, and audit traceability for all ruleset changes and governance activities.
• Maintain and validate governance documentation (SOPs, taxonomy, playbooks) to support compliance with SoX, GxP, and IT control frameworks.
• Provide audit support by preparing evidence for SoX, GxP, and IT compliance reviews, including SoD analysis and control documentation.
• Support process improvement and automation initiatives aligned to the UAM taxonomy, including KPI definition, reporting, and continuous improvement activities.

Experience and Skills

Required

• Bachelor's degree in a relevant field, with a preference for studies in Governance Risk Management, Compliance, and Audit. Engineering, Information Technology or related fields
• 3-5 years of experience in UAM / SAP GRC governance roles within an enterprise risk and control environment
• Hands-on experience with SAP GRC Access Controls
• 3-5 years of experience in conducting IT Audit and assessment of IT Controls
• 3-5 years of experience with regulatory/ compliance frameworks related to SoX, GxP, Privacy/GDPR.
• Strong experience in Segregation of Duties (SoD) concepts, including:
  • Risk analysis at role and user level
  • Ruleset design and maintenance
  • Mitigation and remediation strategies
• Proven experience in GRC ruleset lifecycle management:
  • Intake, assessment, prioritization, and consolidation of changes
  • Exposure to audit-driven updates

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.