Cyber - Sap Security and Grc Access & Process Control Senior Consultant

Deloitte Deloitte · Consulting

This role focuses on implementing and assessing SAP S/4 HANA and/or ECC business process controls, strategy development, assessment, design, testing, and implementation of business process and IT controls frameworks within a client-facing environment. It involves hands-on work with SAP environments, SAP GRC Process Control configuration, control library maintenance, and understanding of automated/continuous controls. Experience with regulatory concerns like Sarbanes Oxley and data regulations is also mentioned.

What you'd actually do

  1. As a Senior Consultant, you will be part of our SAP practice and will be responsible for delivering SAP S/4 HANA and/or ECC business process controls implementations and assessments.
  2. Responsibilities will include strategy and approach development, assessment, design, testing, and implementation of a business process and information technology controls frameworks in a collaborative client-facing environment.
  3. Ability to support control design, documentation, walkthroughs, and testing (design & operating effectiveness) across core business processes across Record to Report, Source to Pay, Order to Cash, Plan to Produce, their inherent risks, and potential controls
  4. 4+ years of experience in SAP GRC Process Control design and configuration with a clear understanding of controls, risks, subprocesses, organizations, and assignments within SAP GRC Process Control.
  5. Ability to produce audit-ready outputs (e.g., control status, test results, open issues, overdue tasks) and explain them to control owners and auditors

Skills

Required

  • Bachelor’s degree
  • 5+ years of experience in ERP controls roles, with hands-on work in SAP environments (ECC and/or S/4HANA)
  • Ability to support control design, documentation, walkthroughs, and testing (design & operating effectiveness) across core business processes across Record to Report, Source to Pay, Order to Cash, Plan to Produce, their inherent risks, and potential controls
  • 4+ years of experience in SAP GRC Process Control design and configuration with a clear understanding of controls, risks, subprocesses, organizations, and assignments within SAP GRC Process Control.
  • 4+ years of experience creating/maintaining control library, narratives/RCMs (or equivalents), and mapping controls to processes, risks, and owners
  • Ability to set up or support self-assessments, test plans, and evidence collection workflows in PC (including tester/approver steps)
  • 2+ years of experience with the concept of automated/continuous controls and how PC can support monitoring using Continuous Control Monitoring (CCM) - creating business rules, data sources, and scheduling jobs to monitor controls and risks
  • 4+ years of experience in documenting internal controls, risk management and remediation processes
  • Ability to produce audit-ready outputs (e.g., control status, test results, open issues, overdue tasks) and explain them to control owners and auditors
  • Can run assigned work independently (workplan, status, RAID items) with Manager oversight and Leads control owner sessions for walkthroughs, evidence expectations, and PC workflow adoption
  • Ability to travel up to 50%, on average, based on the work you do and the clients and industries/sectors you serve

Nice to have

  • Previous Consulting or Big 4 experience
  • Certifications such as: CPA, CISA, CISSP, CISM, or PMP
  • Excellent written and verbal communication skills
  • Full cycle implementation experience with SAP S/4HANA and/or ECC, including risk assessment, control identification, design, testing, and deployment
  • Technical understanding of SAP configurations as it relates to the design, development, and testing of automated controls
  • Strong understanding of regulatory concerns impacting SAP environments, including Sarbanes Oxley and data related regulations (GDPR, CCPA)
  • Strong understanding of relevant leading practices as it relates to control environment

What the JD emphasized

  • 5+ years of experience in ERP controls roles, with hands-on work in SAP environments (ECC and/or S/4HANA)
  • 4+ years of experience in SAP GRC Process Control design and configuration
  • 4+ years of experience creating/maintaining control library, narratives/RCMs (or equivalents), and mapping controls to processes, risks, and owners
  • 2+ years of experience with the concept of automated/continuous controls
  • 4+ years of experience in documenting internal controls, risk management and remediation processes
  • Strong understanding of regulatory concerns impacting SAP environments, including Sarbanes Oxley and data related regulations (GDPR, CCPA)