GRC Specialist: Data Privacy, Access & Audit Readiness

CIMMYT - International Maize and Wheat Improvement Center

Mexico

On-site

PHP 2,214,000 - 3,690,000

Full time

14 days+

Application generator

Turn this role into an interview — a resume and cover letter built around what this employer wants.

Get past ATS filters

Benefits offered by this job

Year-end bonus (40 days)

Vacation premium (56%)

Life and medical insurance

Supermarket coupons

Savings fund

Social Mexican benefits (IMSS, SAR /In

Job summary

CIMMYT - International Maize and Wheat Improvement Center is seeking a GRC Specialist to serve as the internal subject-matter expert for governance, risk, and compliance across the enterprise application ecosystem. You will own access management, SoD control, license reconciliation, data privacy, and audit readiness across Dynamics 365, Power Platform, ICERTIS, and SAP ecosystems.

The role requires 5+ years in IT GRC or IT audit, hands-on ERP SoD design experience, and strong stakeholder

Qualifications

Bachelor's degree in Information Systems, CS, or related field.
5+ years in IT GRC or IT audit; 3+ on enterprise application platforms; ITGC design, testing, remediation.
Experience with Dynamics 365 security model and ERP SoD design or assessment.
Power Platform governance and license reconciliation.
Knowledge of data protection law and ISO 27001, NIST CSF, or COBIT.
Certifications such as CISA/CRISC/CISM/CIPP are a plus; CLM/HRIS/GRC tools advantageous.
Strong analytical skills and proficiency with reporting/dashboard tools; Power BI advantageous.
English proficiency.
Ticketing tools familiarity and D365 administration desirable.
Stakeholder management and communication without direct line authority.

Responsibilities

Own and operate the full-lifecycle Access Management procedure (request, approval, provisioning, modification, recertification, revocation).
Maintain the privileged access elevation model, log set, retention, and monitoring per platform.
Maintain cross-platform SoD conflict matrix and run risk-ranked assessments with remediation.
Review all accounts and reconcile reclaimed accounts to license entitlement.
Maintain entitlement register per platform and quantify license usage gaps.
Maintain data inventory and processing records, retention and disposal schedules.
Maintain ITGC matrix across platforms and drive corrective actions.
Coordinate audit readiness activities and track findings to closure.
Maintain GRC policy, ERP risk register, and dashboards.