GRC Specialist: ERP Security & Compliance Expert

CIMMYT; Estado de México; Presencial; MXN 420.000 - 660.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Year-end bonus (40 days)

Vacation premium (56%)

Life and medical insurance

Supermarket coupons

Savings fund

Mexican social benefits (IMSS, SAR/InF

Diversity-friendly environment

Descripción de la vacante

CIMMYT is seeking a GRC Specialist to serve as the internal subject-matter expert for governance, risk, and compliance across its enterprise application ecosystem. You will own access management, SoD, license reconciliation, data retention, and ITGCs while coordinating with the ERP team and control owners.

Required are 5+ years in IT GRC or IT audit, with Dynamics 365 security exposure and Power Platform governance. Strong English, stakeholder skills, and relevant certifications are valued.

Formación

• Bachelor's degree in Information Systems, Computer Science, or a related field.
• Minimum of 5 years of experience in IT GRC or IT audit, of which at least 3 on enterprise application platforms; ITGC design, testing, and remediation experience in an audited environment.
• Hands-on experience with the Dynamics 365 security model (F&O roles, duties, and privileges; CE role-based security) and practical ERP SoD design or assessment.
• Experience with Power Platform governance (environments, DLP policies, Dataverse security) and license reconciliation.
• Working knowledge of data protection law and of ISO 27001, NIST CSF, or COBIT.
• Experience preferred; CISA, CRISC, CISM, or CIPP certification an advantage; experience with ICERTIS or a comparable CLM platform, HRIS governance, a GRC tool (Pathlock, Fastpath, SAP GRC, ServiceNow IRM), or in multi-jurisdiction environments an advantage.
• Strong analytical skills and proficiency with reporting and dashboard tools; Power BI or equivalent an advantage.
• Full professional proficiency in English.
• Familiarity with ticketing tools and D365 administration highly desirable.
• Strong stakeholder management and communication skills without direct line authority, with the ability to interact professionally with internal clients across IT, Finance, HR, Legal, and vendor teams.

Responsabilidades

• Own and operate the full-lifecycle Access Management procedure (request, approval, provisioning, modification, recertification, revocation).
• Maintain the privileged access elevation model (justification, approval, duration limits, session logging, post-use review).
• Maintain the consolidated cross-platform SoD conflict matrix and run risk-ranked assessments.
• Periodically review all accounts, remediate orphaned accounts, and reconcile reclaimed accounts to license entitlement.
• Maintain an entitlement register per platform, reconcile licenses against usage, and manage security role design for license tiers.
• Maintain the data inventory and processing record, apply retention/disposal schedules, and handle data subject requests within statutory timeframes.
• Maintain and test ITGC matrix across platforms; report deficiencies and drive remediation with owners.
• Keep evidence base audit-ready, run readiness assessments, and coordinate during audits.
• Maintain GRC policy and ERP IT risk register; report breaches via dashboards.
• Assess interface controls and vendor security, review assurance reports and audit rights.
• Operate the exception register with expiry dates and train control owners.
• Deliver monthly progress reports and quarterly GRC dashboard to ERP Program Manager.
• Perform other related tasks as requested by supervisor.

Conocimientos

IT GRC

IT audit

Power BI

Stakeholder mgmt

English proficiency

Educación

Bachelor's degree in IT

Herramientas

Dynamics 365 security

Power Platform governance

ICERTIS

Pathlock

SAP GRC

Descripción del empleo

CIMMYT is seeking a GRC Specialist to serve as the internal subject-matter expert for governance, risk, and compliance across its enterprise application ecosystem. You will own access management, SoD, license reconciliation, data retention, and ITGCs while coordinating with the ERP team and control owners.

Required are 5+ years in IT GRC or IT audit, with Dynamics 365 security exposure and Power Platform governance. Strong English, stakeholder skills, and relevant certifications are valued.