Sr. Analyst, IT - SAP Security Controls

Verano; Chicago, Northern (IL, KY); Hybrid; USD 130,000 - 150,000; Full time

Job summary

Verano is seeking a Sr. Analyst, IT - SAP Security Controls in Chicago to lead SAP security design and ITGC execution. You will own SoD and emergency access governance, coordinate with internal teams, and support SIEM integration while strengthening SOX controls across SAP environments.

You will collaborate with Internal/External auditors, mentor junior staff, and help expand controls to SAP Ariba and SuccessFactors over time.

Qualifications

• 7+ years of hands-on SAP Security experience with strong role design, provisioning, and access-management depth.
• Experience with SAP GRC (Access Control 12.0) is a strong plus.
• Demonstrated hands-on experience owning SAP ITGCs at the control-owner level with User Access Reviews and Audit Logs.

Responsibilities

• Manage SAP role design, provisioning, and de-provisioning aligned to business roles and least-privilege principles.
• Design and maintain the SoD ruleset within current toolset; own SoD analysis, mitigation, and remediation across SAP applications.
• Own Firefighter (Emergency Access) governance — request, approval, monitoring, and log review.
• Support integration of SAP security events with the enterprise SIEM.
• Serve as the control owner for SAP ITGCs and lead quarterly/monthly reviews and attestations.
• Track SOX/ITGC findings and ensure systemic remediation with auditors; expand controls to SAP Ariba and SuccessFactors.

Skills

SAP Security

Role design

Access management

ITGC ownership

SOX remediation

GRC tools

Fastpath/Pathlock

Audit evidence

Stakeholder mgmt

Tools

Fastpath

CSI

Pathlock

SAP Ariba

SuccessFactors

Job description

Sr. Analyst, IT - SAP Security Controls

Department: IT - Applications

Location: Chicago, IL, US, 60610

Verano Holdings Corp. (Cboe CA: VRNO) (OTCQX: VRNO), one of the U.S. cannabis industry’s leading companies based on historical revenue, geographic scope and brand performance, isa vertically integrated, multi-state operator embracing a mission of saying Yes to plant progress and the bold exploration of cannabis. Verano offers a superior cannabis shopping experience in medical and adult use markets under the Zen Leaf™ and MÜV™ dispensary banners and produces a comprehensive suite of high-quality, regulated cannabis products sold under its diverse portfolio of trusted consumer brands including Verano™, MÜV™, Savvy™, BITS™, Encore™, and Avexia™. Verano’s active operations span 13 U.S. states, comprised of 15 Cultivation and production facilities with over 1,000,000 square feet of cultivation capacity. Learn more atwww.verano.com .

Essential Duties and Responsibilities

SAP Security & Access Management

• Manage SAP role design, provisioning, and de-provisioning aligned to business roles and least-privilege principles.
• Design and maintain the SoD ruleset within our current toolset (e.g., Fastpath); own SoD analysis, mitigation, and remediation across SAP applications.
• Own Firefighter (Emergency Access) governance — request, approval, monitoring, and log review.
• Support integration of SAP security events with the enterprise SIEM.

SAP ITGC Ownership and Execution

• Serve as the control owner and executor for SAP-specific ITGCs, including quarterly User Access Review, monthly Termination Review, monthly Privileged User Access Monitoring, monthly Firefighter Log Review, monthly Critical/Administrative Access Review, quarterly SAP Standard Accounts Review, quarterly Role Review, quarterly Audit Log Review, and quarterly Client Open Changes Review.
• Ensure control execution is timely, within the correct review period, with proper reviewer approval, evidence retention, and documentation to support audit and SOX requirements.
• Maintain and improve control templates to ensure accuracy of formulas, scoping, and reviewer instructions; standardize and version-control templates across execution cycles.
• Track and remediate SOX/ITGC findings from internal and external audit; ensure remediation is systemic rather than reactive.
• Partner with Internal Audit and external auditors on requests, walkthroughs, IPE (Information Produced by the Entity) validation, and evidence review.
• Support the expansion of controls coverage to other SAP products (e.g., SAP Ariba, SuccessFactors) as they come into audit scope over time.

Collaboration and Delivery

• Direct and validate work performed by external AMS partners, ensuring quality and alignment with the broader SAP architecture.
• Collaborate with business stakeholders, cross-functional teams, and vendors to ensure successful project delivery and ongoing system support.

Minimum Qualifications

• 7+ years of hands‑on SAP Security experience with strong SAP role design, provisioning, and access-management depth.
• Experience with SAP GRC (Access Control 12.0) is a strong plus.
• Demonstrated hands‑on experience owning and executing SAP‑specific ITGCs at the control‑owner level — not just supporting audit teams. Direct experience with User Access Reviews, Termination Reviews, Firefighter Log Reviews, Change Management, and Audit Log Reviews required.
• Track record of remediating SOX/ITGC audit findings systemically — closing recurring issues rather than patching them each cycle.
• Experience with control evidence retention, IPE validation, reviewer sign‑off standards, and defending controls in front of external auditors.
• Working knowledge of Fastpath (preferred) or comparable tools such as CSI, Pathlock for automated control monitoring, access reviews, and SoD analysis.
• Experience with controls execution for other SAP products such as SAP Ariba and SuccessFactors is a huge plus — these products will be added to the control scope over time.
• Demonstrated ability to lead — mentoring junior team members, setting standards, and directing internal and external contributors on security and controls work.
• Strong communication, stakeholder management, and change management skills; ability to lead through influence across all organizational levels.

Physical and Mental Demands

While performing the duties of this job, the employee is frequently required to remain in a stationary position, move and/or position oneself, communicate, operate and/or prepare, place, position objects, tools, or controls. The employee must occasionally move packages weighing up to 10 lb. Specific vision abilities required by this job include close observation and the ability to adjust focus. The mental and physical requirements described here are representative of those that must be met by an individual, with or without reasonable accommodation, to successfully perform the essential functions of this position.

Work is performed in an office environment. The noise level in the work environment is usually moderate. The work environment characteristics described here are representative of those an individual encounters while performing the essential functions of this position.

We are proud to be an equal opportunity employer. We place priority in an environment of inclusion, diversity and social justice and are committed to securing a better, brighter way forward for our employees, our markets, and our communities.