SAP GRC Access Control Specialist – CISA Certified - IT Audit

DuoBridge; Chennai; On-site; INR 1,200,000 - 2,100,000; Full time

Job summary

DuoBridge is seeking an experienced SAP GRC professional to strengthen our SAP Governance, Risk, and Compliance framework in Chennai. The role focuses on SAP GRC Access Control, SoD risk analysis, and IT general and application controls within SAP and related environments.

You will partner with IT and business stakeholders to investigate audit findings, track remediation progress, and support audits and security reviews. Strong English communication is essential.

Qualifications

• Bachelor's degree in Information Systems, Computer Science, Accounting, or a related field.
• 8–12 years of combined IT audit experience with a strong focus on SAP GRC and access controls.
• Certification: CISA is required; ITIL Foundation is a plus.

Responsibilities

• Design, configure, and maintain SAP GRC Access Control with risk rulesets and remediation workflows.
• Review SAP user access, role assignments, privileged access, and emergency access (Firefighter) to identify SoD conflicts.
• Monitor SAP access controls across procure-to-pay, order-to-cash, and user access management to ensure policy compliance.
• Assess IT general controls (ITGC), application controls, and infrastructure controls using benchmarking against frameworks like NIST.
• Collaborate with IT and business stakeholders to investigate audit findings and drive remediation progress.
• Support external and internal audit engagements, including planning, fieldwork, reporting and issue follow-up for SAP-based systems.
• Evaluate third-party service reports (ISAE 3402/SOC) for outsourced IT support functions.
• Conduct vulnerability assessments and support broader IT security reviews with the security team.
• Develop and deliver training to key users, auditors, and auditees on GRC processes and controls.
• Maintain and enhance audit issue tracking workflows reflecting current practices.

Skills

SAP GRC Access Control

SoD risk analysis

ITGC

IT audit

CISA certification

ITIL Foundation

CyberArk

Nmap

Nessus

ACL

TeamMate

English proficiency

Education

Bachelor's degree in Information Systems, Computer Science, or related field

Tools

SAP GRC Access Control

SAP modules MM/ FI/ PP/ QM/ PM/ SD

CyberArk

ACL

TeamMate

Nessus

Nmap

Job description

SAP GRC

Location: Chennai

Department: GPO – Process Owner

About The Role

We are seeking an experienced SAP GRC resource to manage and strengthen our SAP Governance, Risk, and Compliance framework. The ideal candidate will bring hands‑on expertise in SAP access controls, segregation of duties (SoD) risk analysis, and IT general controls (ITGC), combined with a strong background in IT audit. This role is critical to ensuring our SAP environment is secure, compliant, and aligned with internal control and regulatory requirements.

Key Responsibilities

• Design, configure, and maintain SAP GRC Access Control, including access risk rulesets, mitigating controls, and remediation workflows.
• Perform periodic reviews of SAP user access, role assignments, privileged access, and emergency access management (Firefighter) to identify and remediate segregation of duties (SoD) conflicts.
• Review and monitor SAP access controls across key business cycles (procure-to-pay, order-to-cash, user access management) to ensure compliance with company policies and industry standards.
• Assess IT general controls (ITGC), application controls, and infrastructure controls within SAP and related environments, benchmarking against frameworks such as NIST.
• Partner with IT and Business stakeholders to investigate audit findings, track remediation progress, and drive continuous improvement in control effectiveness.
• Support external and internal audit engagements, including planning, fieldwork, reporting, and issue follow-up for SAP-based systems.
• Evaluate third‑party service reports (e.g., ISAE 3402/SOC reports) for outsourced IT support functions.
• Conduct vulnerability assessments and support broader IT security reviews in collaboration with the security team.
• Develop and deliver training to key users, internal auditors, and auditees on GRC processes, tools, and controls.
• Maintain and enhance audit issue tracking systems, ensuring workflows reflect current audit practices.

Required Qualifications

• Bachelor's degree in Information Systems, Computer Science, Accounting, or a related field.
• Minimum 8–12 years of combined experience in IT audit (internal and/or external) with a strong focus on SAP access controls and GRC.
• Proven hands‑on experience with SAP GRC (Access Control), including access risk analysis, mitigating control assignment, and SoD rulesets.
• Working knowledge of SAP modules (MM, FI, PP, QM, PM, SD) and how they intersect with access risk.
• Solid understanding of ITGC, application controls, and vulnerability management processes.
• Experience with Identity & Access Management tools (e.g., CyberArk) and privileged access reviews.
• Familiarity with audit and data analytics tools such as ACL and TeamMate.
• Professional certification: CISA (Certified Information Systems Auditor) required; ITIL Foundation a plus.
• Experience with vulnerability assessment tools (e.g., Nmap, Nessus) is advantageous.
• Strong communication skills, with the ability to translate technical findings into actionable business recommendations.
• Proficiency in Microsoft Office (Excel, Word, Visio, PowerPoint).

Preferred Attributes

• Prior exposure to Big 4 audit methodology or large‑scale internal audit functions.
• Experience delivering GRC or access‑control training to end users and auditors.
• Fluency in English.

What We Offer

• Opportunity to lead and shape the SAP GRC function within a growing organization.
• Exposure to cross-functional projects spanning IT, security, and business operations.
• Competitive compensation and professional development support.

Skills: sap pp,sap materials management (sap mm),sap qm,sap fi,cisa,itgc,grc,sap module,sap,sap sd,risk,sap grc access control,sap pm module,it audit