Senior Information Security Governance, Risk & Compliance Analyst

MiniMed

Minnesota

On-site

USD 110,000 - 170,000

Full time

14 days+

Application generator

Don’t send a generic resume — generate a resume and cover letter tailored to this exact role.

Get past ATS filters

Job summary

MiniMed is seeking a Senior Information Security Governance, Risk & Compliance Analyst to provide second-line oversight across SAP GRC, SOX ITGC, and control assurance in a global medical technology environment. You will partner with Information Security, IT, Finance, Privacy, Legal, Internal Audit, and business stakeholders to assess risks and strengthen governance practices.

The role requires deep knowledge of access governance, risk management, and compliance requirements, with hands-on

Qualifications

Bachelor’s degree or equivalent in information security, risk management, or related field.
Minimum 7 years in Information Security GRC, risk management, SOX ITGC, internal/external audit, or related areas.
Strong knowledge of SAP GRC Access Control and Process Control administration.
Experience with regulatory compliance frameworks (SOX, ISO 27001) and control documentation.

Responsibilities

Coordinate and monitor enterprise Segregation of Duties governance across SAP and other platforms.
Administer SAP GRC Access Control and related capabilities (Access Risk Analysis, Access Request, Emergency Access).
Maintain SoD rulesets, risk functions, mitigating controls, and evidence.
Monitor SoD conflicts, privileged access, and control effectiveness.
Develop dashboards and reports to support governance, risk, and compliance activities.
Support audit responses and evidence collection.
Contribute to governance operations, policy development, and control optimization.

Skills

Information Security

GRC

risk management

SOX ITGC

SAP Security Governance

regulatory compliance

data protection

Education

Bachelor’s degree in Information Security or related field

Tools

SAP GRC Access Control

SAP GRC Process Control

SAP Security Governance

Job description

We anticipate the application window for this opening will close on - 1 Sep 2026

At MiniMed, you can begin a lifelong career of exploration and innovation, while helping make a difference in the lives of people living with diabetes around the globe. You'll lead with purpose, breaking down barriers to innovation for a more connected, compassionate world.

About The Role

The Senior Information Security Governance, Risk & Compliance Analyst is a seasoned individual contributor responsible for supporting enterprise governance, risk, compliance, access governance, SAP GRC, SOX ITGC, and assurance activities. This second-line role provides independent oversight, monitoring, reporting, and control assurance to strengthen information security, technology compliance, and risk management capabilities. The role partners across Information Security, IT, IAM, Finance, Internal Audit, Privacy, Legal, and business stakeholders to assess risks, support regulatory obligations, improve control effectiveness, and mature governance practices across a global public medical technology environment.

Responsibilities may include the following and other duties may be assigned.

Access Governance & Segregation of Dutie

Coordinate and support enterprise Segregation of Duties governance across SAP and other key enterprise platforms.
Administer SAP GRC Access Control capabilities, including Access Risk Analysis, Access Request Management, Emergency Access Management, and Business Role Management.
Maintain SoD rulesets, risk functions, mitigating controls, access governance documentation, and related control evidence.
Assess access risks, including SoD conflicts, excessive entitlements, privileged access exposure, and control effectiveness concerns.
Monitor access-related exceptions, remediation plans, compensating controls, metrics, and trends to support risk reduction and compliance obligations.
Partner with application owners, IAM, SAP Security, and business stakeholders to evaluate and address identified access governance risks

User Access Review & Privileged Access Governance

Coordinate and manage periodic User Access Reviews and access certification activities.
Monitor completion rates, overdue certifications, and non-compliance issues in accordance with governance requirements.
Support oversight of privileged access, emergency access, Firefighter governance, and related monitoring activities.
Review privileged access activity and maintain evidence supporting user access governance controls.

SOX ITGC Compliance & Control Monitoring

Administer and support SAP GRC Process Control activities used to monitor, assess, and validate SOX IT General Controls and security compliance requirements.
Support SOX ITGC compliance execution, control monitoring, audit evidence collection, validation, retention, and reporting.
Assist control owners and stakeholders with control procedures, evidence requirements, deficiencies, findings, remediation tracking, and closure activities.
Develop dashboards, metrics, and reporting to support management self-assessment, continuous control monitoring, and control effectiveness improvements.

Audit & Assurance Support

Support internal audits, external audits, and regulatory assessments by coordinating evidence, documentation, walkthroughs, and audit responses.
Maintain audit-ready documentation repositories and supporting records.
Monitor remediation activities and validate completion of corrective actions.
Perform control assurance activities by reviewing evidence completeness, control execution, and remediation effectiveness.

Governance & Compliance Operations

Support the development, implementation, and maintenance of information security policies, standards, procedures, governance processes, and control frameworks.
Support control inventory management, exception management, compliance reporting, GRC tool administration, workflows, dashboards, and reporting capabilities.
Develop compliance and risk metrics to monitor program effectiveness and identify opportunities for process improvement, automation, and control optimization.
Contribute to scalable governance standards, operational procedures, and compliance monitoring practices that strengthen enterprise security governance.

Risk Management Support

Assess cybersecurity, technology, artificial intelligence, data protection, and operational risks through structured risk assessment and governance processes.
Facilitate information security risk assessments supporting governance, compliance, and enterprise risk management activities.
Maintain risk registers, treatment plans, issue logs, action tracking, KRIs, risk dashboards, and management reporting.
Evaluate mitigation strategies and control implementation activities to support informed business and technology decision-making.

Stakeholder Collaboration & Advisory Support

Partner with Information Security, Information Technology, Finance, Privacy, Internal Audit, Legal, Enterprise Risk Management, and business stakeholders.
Translate technical risks, access governance issues, and compliance requirements into clear, business-focused recommendations.
Facilitate assessments, workshops, compliance reviews, and cross-functional discussions to promote risk-informed decision-making.
Provide subject matter guidance on governance, compliance, access governance, risk management, and security control requirements.

Second-Line Independence & Governance Boundaries

This role provides oversight, monitoring, reporting, governance, compliance, risk management, and assurance activities while maintaining appropriate second-line independence. The role partners with first-line teams to evaluate control design, monitor execution, assess risk, validate evidence, and support remediation governance while preserving independent oversight responsibilities.

Required Qualifications

Bachelor’s degree in Information Security, Cybersecurity, Information Systems, Risk Management, Business Administration, Accounting, Finance, Audit, or a related discipline, or equivalent combination of education and experience.
Minimum 7 years of experience in Information Security GRC, Information Security Risk Management, SOX ITGC Compliance, Internal Audit, External Audit, Access Governance, Identity Governance, SAP Security Governance, Compliance Management, or Internal Controls Management.
Requires advanced knowledge of Information Security GRC, access governance, regulatory compliance, risk management, and internal controls.
Requires strong understanding of SAP GRC Access Control and SAP GRC Process Control administration. Typically obtained through advanced education combined with significant professional experience in information security, compliance, governance, risk management, audit, or internal controls.
Current SAP Certified Application Associate, SAP Access Control certification required.
Current SAP GRC Process Control certification required.

Preferred Qualifications

Hands-on experience administering SAP GRC capabilities supporting SoD, UAR, EAM, SOX ITGC, continuous control monitoring, compliance reporting, and audit evidence management.
Experience administering SAP GRC Access Risk Analysis, Access Request Management, Emergency Access Management, Business Role Management, and SAP GRC Process Control.
Experience maintaining SoD rulesets, mitigating controls, access-risk libraries, access review campaigns, compliance dashboards, and audit evidence repositories.
Experience supporting SOX ITGC testing, walkthroughs, evidence requests, remediation tracking, and audit readiness activities.
Working knowledge of SAP authorization concepts, including roles, profiles, transaction codes, and role-based access controls.
Strong analytical, documentation, reporting, stakeholder management, and business communication skills.
SAP GRC Risk Management Certification or experience administering SAP GRC Risk Management solutions.
Professional certifications such as CISA, CRISC, CIA, CISM, CISSP, GRCP, or CPA.
Experience supporting public-company SOX 404 compliance programs.
Experience in medical device, healthcare, life sciences, pharmaceutical, manufacturing, or other highly regulated industries.
Experience supporting enterprise access governance platforms beyond SAP, including Oracle, Workday, ServiceNow, SailPoint, Entra ID, or comparable platforms.
Experience developing compliance dashboards, risk reporting, and executive-facing control metrics.
Experience supporting enterprise information security risk management programs.

Framework Knowledge