Senior Manager — SAP GRC Solution Architect, Audit & Compliance Governance

Overview

Senior Manager and global solution architect for SAP GRC and audit and compliance governance, owning role design, segregation of duties, Access Control operations, and SOX IT controls across the SAP landscape.

What you'll do

• Own the global SAP role design strategy and architecture, including business role catalog, derivation strategy, naming standards, and design principles.
• Design and maintain the segregation of duties ruleset, aligned to business process risk and validated with internal audit, external audit, and process owners.
• Own risk analysis, mitigation control design, and the remediation roadmap for SoD conflicts, including the standing view of accepted risk and who accepted it.
• Establish role lifecycle management: change control, testing, approval, and periodic recertification with named, accountable business role owners.
• Own SAP GRC design, configuration, and operations across Access Risk Analysis, Emergency Access Management, Business Role Management, and Access Request Management, and Process Control where applicable.
• Operate GRC as a product with a backlog and release cadence: ruleset maintenance, workflow design, connector management, and continuous improvement.
• Own Emergency Access Management end to end, including firefighter provisioning model, allocation approach, activity logging, and log review discipline within required windows.
• Ensure any provisioning path outside GRC (cutover accounts, data load IDs, technical users) is deliberately designed, time-bound, monitored, and formally closed.
• Own user provisioning and deprovisioning integration with identity management, joiner-mover-leaver processes, and HR-driven access lifecycle.
• Own SOX IT general controls and application controls for the SAP landscape: access to programs and data, program change, program development, and computer operations.
• Serve as primary interface to internal audit, external audit, and control owners for evidence provision, walkthrough support, deficiency response, and remediation tracking to closure.
• Design controls so evidence is generated as a byproduct of the system operating correctly.
• Maintain continuous control monitoring across access, configuration, and financial process controls, with exceptions routed to owners.
• Own the compliance framework for data privacy and regulatory requirements as they apply to SAP data across regions.
• Provide GRC and controls readiness as a formal go-live gate for every deployment wave.
• Partner with the ABAP and BTP team on SoD-safe development standards, custom transaction and Fiori app risk classification, and authorization object design.
• Partner with the Basis Leader on technical security operations, privileged access, and audit logging.
• Partner with process owners and the Data Conversion and MDG leads so control design reflects actual process design.
• Lead a global team of GRC and security consultants across onshore and offshore, and hold AMS and system integrator partners accountable for role quality and control adherence.

What you'll need

• 15+ years in SAP security and GRC, with at least 5 years in a solution architect or global leadership capacity.
• Deep hands-on SAP GRC Access Control expertise (ARA, EAM, BRM, ARM), including ruleset design, workflow configuration, and connector architecture in production.
• Expert-level S/4HANA authorization design: authorization objects, Fiori catalogs, groups and spaces, business roles, and differences from classical ECC role design.
• Proven ownership of SoD ruleset design and remediation on a global program, with demonstrated conflict reduction rather than documented conflict.
• Strong SOX ITGC and application control experience in a publicly listed environment, with direct external audit engagement.
• Demonstrated design of controls that are automated and continuously evidenced, not dependent on manual periodic execution.
• Experience delivering security and controls through multi-wave global S/4HANA deployments, including cutover and hypercare.
• Ability to hold a control position under delivery pressure and explain to a program leader why an exception costs more than the delay.

Nice to have

• SAP Identity Management, IAG, or third-party IAM integration (SailPoint, Saviynt, Okta).
• SAP Process Control, Risk Management, or continuous control monitoring platforms.
• RISE with SAP security and shared responsibility model experience.
• BTP security architecture, identity propagation, and authorization models.
• CISA, CISM, CRISC, or SAP security certification.
• Manufacturing or industrial sector control environment, including plant-level and trade compliance considerations.

Details

• Location: Bangalore.