Senior Manager - SAP GRC Solution Architect, Audit & Compliance Governance

Xylem; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Xylem in Bengaluru, India is seeking an experienced SAP security and GRC leader to own the global design and governance of access control across SAP landscapes. This role focuses on SoD risk management, role lifecycle, and SOX ITGC controls, delivering automated evidence and scalable controls across multi-wave deployments.

You will lead a global team of GRC consultants, partner with ABAP, Basis, and data teams, and ensure compliant provisioning for joiners, movers, and leavers while coordinating

Qualifications

• 15+ years in SAP security and GRC, with leadership experience in global programs.
• Deep hands-on SAP GRC Access Control expertise - ARA, EAM, BRM, ARM and connectors.
• Expert-level S/4HANA authorization design and understanding of Fiori catalogs and roles.
• Proven ownership of SoD ruleset design and remediation on global programs.
• Strong SOX ITGC and application control experience in publicly listed environments.

Responsibilities

• Own global SAP role design strategy and architecture, including business role catalog and derivation standards.
• Design and maintain SoD ruleset aligned to process risk and audit requirements.
• Own risk analysis, mitigation controls, and remediation roadmap for SoD across landscape.
• Establish role lifecycle management with change control, testing, and recertification.
• Own SAP GRC design, configuration, and operations across Access Control and Process Control.
• Operate GRC as a product with backlog, release cadence, and continuous improvement.
• Own Emergency Access Management end-to-end (firefighter provisioning, logging, reviews).
• Ensure provisioning outside GRC is time-bound, monitored, and closed at go-live.
• Own user provisioning/deprovisioning integration with identity management and HR lifecycle.
• Own SOX ITGC and application controls across SAP landscape; interface with internal/external audits.

Skills

GRC Expertise

SoD Analysis

S/4HANA Authorization

SOX ITGC

Leadership

Tools

BRM/ARM tooling

EAM configuration

ABAP integration

Job description

Xylem is a Fortune 500 global water solutions company dedicated to advancing sustainable impact and empowering the people who make water work every day. As a leading water technology company with 23,000 employees operating in over 150 countries, Xylem is at the forefront of addressing the world's most critical water challenges. We invite passionate individuals to join our team, dedicated to exceeding customer expectations through innovative and sustainable solutions.

Access control architecture and role design

• Own the global SAP role design strategy and architecture - business role catalog, derivation strategy, naming standards, and the design principles that keep roles maintainable as segments and waves are added.
• Design and maintain the segregation of duties ruleset, aligned to business process risk and validated with internal audit, external audit, and process owners rather than accepted as a vendor default.
• Own risk analysis, mitigation control design, and the remediation roadmap for SoD conflicts across the landscape, including the standing view of accepted risk and who accepted it.
• Establish role lifecycle management: change control, testing, approval, and periodic recertification with business role ownership that is named and accountable.

SAP GRC solution ownership

• Own SAP GRC design, configuration, and operations across Access Control - Access Risk Analysis, Emergency Access Management, Business Role Management, and Access Request Management - and Process Control where applicable.
• Operate GRC as a product with a backlog and release cadence: ruleset maintenance, workflow design, connector management, and continuous improvement.
• Own Emergency Access Management end to end - firefighter provisioning model, allocation approach, activity logging, and log review discipline enforced within required windows. Where review timeliness has slipped in the past, you own the design change that makes it structurally difficult to slip again
• Ensure any provisioning path that operates outside GRC - cutover accounts, data load IDs, technical users - is deliberately designed, time-bound, monitored, and formally closed, never left as an undocumented residue after go-live.
• Own user provisioning and deprovisioning integration with identity management, joiner-mover-leaver processes, and HR-driven access lifecycle.

Audit and compliance governance

• Own SOX IT general controls and application controls for the SAP landscape: access to programs and data, program change, program development, and computer operations.
• Serve as primary interface to internal audit, external audit, and control owners - evidence provision, walkthrough support, deficiency response, and remediation tracking to closure.
• Design controls so evidence is generated as a byproduct of the system operating correctly, rather than assembled manually at audit time.
• Maintain continuous control monitoring across access, configuration, and financial process controls, with exceptions routed to owners for action.
• Own the compliance framework for data privacy and regulatory requirements as they apply to SAP data across regions.

Deployment wave and program integration

• Provide GRC and controls readiness as a formal go-live gate for every deployment wave: role build, SoD analysis, mitigating controls in place, and clean provisioning before cutover.
• Partner with the ABAP and BTP team on SoD-safe development standards, custom transaction and Fiori app risk classification, and authorization object design.
• Partner with the Basis Leader on technical security operations, privileged access, and audit logging.
• Partner with process owners and the Data Conversion and MDG leads so control design reflects the actual process design, not an idealized version of it.
• Lead a global team of GRC and security consultants across onshore and offshore, and hold AMS and system integrator partners accountable for role quality and control adherence.

Qualifications

Required

• 15+ years in SAP security and GRC, with at least 5 years in a solution architect or global leadership capacity.
• Deep hands-on SAP GRC Access Control expertise - ARA, EAM, BRM, ARM - including ruleset design, workflow configuration, and connector architecture in production.
• Expert-level S/4HANA authorization design: authorization objects, Fiori catalogs, groups and spaces, business roles, and the differences from classical ECC role design.
• Proven ownership of SoD ruleset design and remediation on a global program, with demonstrated conflict reduction rather than documented conflict.
• Strong SOX ITGC and application control experience in a publicly listed environment, with direct external audit engagement.
• Demonstrated design of controls that are automated and continuously evidenced, not dependent on manual periodic execution.
• Experience delivering security and controls through multi-wave global S/4HANA deployments, including cutover and hypercare.
• Ability to hold a control pos