Senior SAP GRC Lead - Identity & Access Governance

BMI Suomi (Icopal Oy, Icopal Katto Oy, Ormax Tiilikatot); United States; On-site; USD 140,000 - 193,000; Full time

Benefits offered by this job

Health insurance options

Family-building benefits

401K with employer match

Wellness program

Job summary

GAF is seeking a senior SAP GRC Lead to govern identity, access, risk, and compliance across our SAP landscape. You will own end-to-end GRC strategy, including SAP GRC Access Control, IAG on BTP, and security models for Ariba, SAC, and IBP.

You will drive SoD mitigation, access governance, and audit readiness across on-premise and cloud systems. The role demands experience leading GRC programs, strong collaboration with internal audit, IT security, and business process owners, and a track record

Qualifications

• Bachelor’s Degree is required; 8+ years SAP security and GRC experience, with at least 3 years in a lead or architect capacity.
• Deep hands-on expertise with SAP GRC Access Control (AC 12.x): ARM, ARA, EAM, BRM
• Proven experience implementing and administering SAP IAG on BTP
• Experience governing the security model for SAP Ariba, SAP Analytics Cloud, or SAP IBP
• Strong understanding of SoD concepts, audit principles, and access control frameworks (SOX, ITGC)

Responsibilities

• Define and maintain the enterprise GRC framework spanning SAP on-premise and cloud
• Own the SoD rule-set across all connected SAP systems; manage conflict detection and mitigation
• Lead periodic access review and certification campaigns; drive remediation to closure
• Establish policies for privileged access, emergency access management, and periodic user access reviews
• Administer and configure SAP GRC AC modules: ARM, ARA, EAM, BRM
• Design and maintain the GRC connector landscape for S/4HANA, ECC, and connected SaaS systems
• Manage workflow configuration, MSMP routing rules, and approval hierarchies
• Perform ruleset reviews and fine-tune risk definitions to minimize false positives while maintaining SOX/audit coverage
• Own the SAP IAG deployment on BTP: tenant configuration, IAS integration, access analysis, and role assignment workflows
• Govern the security model for SAP Ariba, SAC, and IBP including role design and provisioning

Skills

SAP GRC Access Control

SAP Identity Access Governance (IAG)

SoD risk mitigation

Audit readiness

GRC governance

Education

Bachelor’s Degree

Tools

SCIM API integration

S/4HANA

SAP BTP XSUAA

Job description

GAF is seeking a senior SAP GRC Lead to govern identity, access, risk, and compliance across our SAP landscape. You will own end-to-end GRC strategy, including SAP GRC Access Control, IAG on BTP, and security models for Ariba, SAC, and IBP.

You will drive SoD mitigation, access governance, and audit readiness across on-premise and cloud systems. The role demands experience leading GRC programs, strong collaboration with internal audit, IT security, and business process owners, and a track record