Duties

1. Configurable, Interface and CACs controls (SAP)

• Review design of controls specification and develop controls for new business processes ; based on performing risk assessments, analyzing business needs, and aligning with global PIRT and GCS standards;
• In coordination with Sector Controls ensure the following are complete & accurate at all times ; appropriate owners for each part of the controls agenda (data owners, role owners, risk acceptors, CO, PO) as well as the formal controls tools (risk control matrix, assessments, control techniques and test scripts);
• Periodic testing of existing controls, analysis and documentation of testing results. This will also require pre and post implementation testing as part of change management process or project lifecycle.
• Propose and align both locally and globally, appropriate remedation plans for ineffective controls; can include re-design of processes within various business functions, alignment of new owners or new tasks for various business or IT contributors, performing training or sharing analysis & trends.
• Align and coordinate technical changes/remediation with IT departments both locally and globally, ensuring local remediation needs are consistent with global PIRT and GCS standards.
• Continuous improvement of techniques, tools and communications for controls execution, monitoring, testing and control environment.
• Formal reporting, documentation, issue explanation, analysis of results & trends, for both SOX and GCS controls

2. SOD and Application Security management (SAP)

• Build controls capability within business functions ; support and drive access on the basis of “least privilege” as well as avoidance of SoDs ; ensure business data owners are identified, trained & informed on access requirements across all levels of the organization.
• Review new roles created in the global SAP system have no negative SoD or inappropriate access risks for Russia BUCCA, analyzing transactions vs job function with IT & Business.
• Propose, design, or review manual or automated mitigating controls where business requires due to SoD conflicts, after risk assessment of the business needs and impact ; target Zero unmitigating SoD conflicts
• Resolution of SoD conflicts on live processes (tickets processing); address conflicts as they arise by discussing needs with business functions and coordinating technical or process based solutions to ensure inappropriate access is never granted by the IT operations teams.
• Drive cleanup of SoD or security conflicts with Zero impact to operations, coordinating with IT and Service Management to avoid Critical Incidents resulting from role removals (ie. Identify un-used roles, identify & investigate opportunities to simplify access requirements, ensure all roles have appropriate owners)
• Communication with the Business, Security team, Sector, Project team (if required) to align efforts on SoD and Access Review conflicts resolution.
• Continuous improvement of techniques, tools and communications for controls execution, monitoring, testing and control environment. For Security controls this may include robotics analysis
• Formal reporting, documentation, issue explanation, analysis of results & trends, for both SOX and GCS controls​​​​

Work Experience:

• At least 1-2 years in ERP (Enterprise resource planning system) projects (either as employee of consulting company or from client’s side, freelancer);
• Experience of IT auditor is a must;
• SAP project experience is a plus ( FICO – finance\controlling; MM/SD – material management\sales&distribution modules);GRC (Governance, risk and compliance module) experience
• Education: higher
• Key Skills: risk assessment, analytics, good collaboration and communication skills, ability to work independently across many levels in the organization
• Fluent English language (read/write) is a must