Senior SAP GRC ITAC Consultant

EY; Ernakulam; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

EY in Kerala seeks an experienced SAP GRC professional to support client engagements across SAP GRC, ITGC and ITAC, focusing on testing, documentation and risk assessment.

You will perform control walkthroughs, SoD reviews and data analysis, collaborating with audit teams to deliver high-quality SAP risk services for clients in the MENA region, with travel as required.

Qualifications

• 3-6 years of experience in SAP GRC, SAP security, SAP ECC, SAP S4 HANA, IT audit, compliance testing or technology risk consulting.
• Exposure to SAP ECC/S/4HANA security, Oracle security or other ERP security models preferred.
• Understanding of ERP system landscapes, access control concepts, SoD, sensitive access and user access review processes.
• Knowledge of ITGC, ITAC, RCM documentation, testing methodology and issue documentation.
• Exposure to SOX, ICOFR, internal audit or IT risk standards.
• Strong Excel and documentation skills with attention to evidence completeness and workpaper quality.
• Bachelor's degree in Information Systems, Computer Science, Accounting, Finance or a related discipline.

Responsibilities

• Support execution of SAP GRC, SAP ITAC and IT risk consulting projects across SAP ECC and SAP S/4HANA environments.
• Perform control walkthroughs, evidence review and testing for ITGC, ITAC and automated controls.
• Assist in the assessment, design and documentation of SAP IT application controls and automated controls.
• Conduct SoD and sensitive access reviews, including data analysis, rule set review, exception validation and remediation follow-up.
• Support SAP GRC Access Control testing, including workflow validation, access risk analysis, emergency access and user access review activities as applicable.
• Prepare and maintain project deliverables such as RCMs, testing workpapers, issue logs, evidence trackers and status updates.
• Assist with data extraction and analysis for access management, control monitoring, process compliance and audit support.
• Collaborate with internal teams, client stakeholders and audit teams to collect system/process information and close documentation gaps.
• Follow firm quality standards for testing, documentation and deliverable preparation.
• Communicate clearly and proactively to support issue resolution, follow-up and project delivery.

Skills

English communication

Analytical thinking

MS Office

Excel

Power BI

Data analysis tools

Travel flexibility

Education

Bachelor's degree in IS/CS/Accounting/Finance

Tools

ACL

Excel

Power BI

Job description

Job Summary

As part of Risk Consulting, the Senior will support client engagements related to SAP GRC, SAP IT application controls, IT general controls, internal audit and risk management for clients across the MENA region. The role is intended for hands-on SAP GRC and ITAC professionals who can execute high-quality testing, documentation and analysis in a fast-growing SAP GRC practice.

The opportunity

We are looking for experienced professionals with SAP GRC, SAP security, ITAC and ITGC exposure to join the Risk Consulting - Digital Risk team. This role provides an opportunity to work on varied SAP GRC and IT controls engagements, develop deeper consulting skills and contribute to building a strong SAP GRC delivery capability in Kerala.

Your key responsibilities

• Support execution of SAP GRC, SAP ITAC and IT risk consulting projects across SAP ECC and SAP S/4HANA environments.
• Perform control walkthroughs, evidence review and testing for ITGC, ITAC and automated business controls in line with project methodology.
• Assist in the assessment, design and documentation of SAP IT application controls and automated controls.
• Conduct SoD and sensitive access reviews, including data analysis, rule set review, exception validation and remediation follow-up.
• Support SAP GRC Access Control testing, including workflow validation, access risk analysis, emergency access and user access review activities as applicable.
• Prepare and maintain project deliverables such as RCMs, testing workpapers, issue logs, evidence trackers and status updates.
• Assist with data extraction and analysis for access management, control monitoring, process compliance and audit support.
• Collaborate with internal teams, client stakeholders and audit teams to collect system/process information and close documentation gaps.
• Follow firm quality standards for testing, documentation and deliverable preparation.
• Communicate clearly and proactively to support issue resolution, follow-up and project delivery.

Skills and attributes for success

• Strong spoken and written English with clear business communication skills.
• Analytical, organized and detail-oriented approach to testing, documentation and evidence review.
• Ability to work well under pressure and deliver quality outputs within defined deadlines.
• Strong collaboration skills with the ability to work with internal teams, clients and auditors.
• Good understanding of project discipline, task ownership and quality expectations.
• Proficiency in MS Office, working knowledge of Excel, Power BI, ACL or similar data analysis tools is preferred.
• Flexibility to travel to onsite locations at short notice, based on client and engagement requirements.

To qualify for the role, you must have

• 3-6 years of experience in SAP GRC, SAP security, SAP ECC, SAP S4 HANA, IT audit, compliance testing or technology risk consulting.
• Exposure to SAP is required, exposure to SAP ECC/S/4HANA security, Oracle security or other ERP security models is preferred.
• Understanding of ERP system landscapes, access control concepts, SoD, sensitive access and user access review processes.
• Knowledge of ITGC, ITAC, RCM documentation, testing methodology and issue documentation.
• Exposure to SOX, ICOFR, internal audit or IT risk standards.
• Strong Excel and documentation skills with attention to evidence completeness and workpaper quality.
• Bachelors degree in Information Systems, Computer Science, Accounting, Finance or a related discipline.

Ideally, you will also have

• SAP GRC, CISA, ISO 27001, Oracle security or other relevant certifications.
• Experience supporting SAP GRC Access Control implementation/testing or SAP security role review projects.
• Exposure to S/4HANA access, user provisioning workflows, SoD rule set testing or controls automation.
• Prior experience supporting MENA clients, internal audit teams or external audit engagements.