SAP GRC Consultant IT Audit & Access Controls

SAP GRC Consultant – IT Audit & Access Controls

Location: Chennai
Experience: 4–6 years

Role Overview
We are looking for an SAP GRC professional with a strong IT Audit background to manage and strengthen the SAP Governance, Risk and Compliance framework. The role requires hands-on expertise in SAP GRC Access Control, Segregation of Duties (SoD) risk analysis and IT General Controls (ITGC). It ensures the SAP environment stays secure, compliant and aligned with internal control and regulatory requirements. The position reports to the Global Process Owner.

Key Responsibilities

• Design, configure and maintain SAP GRC Access Control, including access risk rulesets, mitigating controls and remediation workflows.


• Conduct periodic reviews of SAP user access, role assignments, privileged access and Firefighter (emergency access) to identify and remediate SoD conflicts.


• Monitor access controls across key business cycles, including Procure-to-Pay, Order-to-Cash and User Access Management.


• Assess ITGC, application controls and infrastructure controls within SAP environments, benchmarking against frameworks such as NIST.


• Work with IT and business stakeholders to investigate audit findings, track remediation and improve control effectiveness.


• Support internal and external audit engagements across planning, fieldwork, reporting and issue follow-up for SAP systems.


• Evaluate third-party assurance reports (ISAE 3402 / SOC) for outsourced IT functions.


• Conduct vulnerability assessments and support IT security reviews with the security team.


• Train key users, internal auditors and auditees on GRC processes, tools and controls.


• Maintain and enhance audit issue tracking systems and workflows.

Qualifications (All Mandatory)

• Bachelor’s degree in Information Systems, Computer Science, Accounting or a related field.


• 4–6 years of experience in IT Audit (internal and/or external), with a strong focus on SAP Access Controls and GRC.


• Hands-on experience with SAP GRC Access Control, including access risk analysis, mitigating control assignment and SoD rulesets.


• Working knowledge of SAP modules (MM, FI, PP, QM, PM, SD) and how they relate to access risk.


• Solid understanding of ITGC, application controls and vulnerability management.


• Experience with Identity & Access Management tools such as CyberArk, and with privileged access reviews.


• Familiarity with audit and analytics tools such as ACL and TeamMate.


• CISA certification is required. ITIL Foundation is a plus.


• Exposure to vulnerability assessment tools such as Nmap or Nessus is an advantage.


• Proficiency in MS Office, including Excel, Word, Visio and PowerPoint.

Candidate Profile

• An IT Audit professional with Big 4 or large-scale internal audit experience.


• Has delivered GRC or access-control training to end users and auditors.


• A strong communicator who can turn technical findings into clear business recommendations.


• Fluent in English.