Security Manager (GSOC, CSIRT) Full Time

Hanson Regan Ltd

The Security & Controls Specialist holds a pivotal role in the day-to-day governance of business systems. This specialist is central to the design, operation, and governance of User and Access Management processes, leveraging supporting technologies. The role extends to offering continuous guidance and monitoring to ensure effective control. Additionally, the incumbent will champion world-class policies and processes, integrating the latest technologies and innovations.

Reason for Role: Given the extensive user base across diverse businesses and locations, the User and Access Management function emerges as critical for overall success. With significant investments in strengthening controls, particularly within key systems like SAP, the Security & Controls Specialist ensures the sustainability and robustness of the controls environment. Notably, as a substantial portion of the SAP team is outsourced and maintained offshore, additional assurance requirements are imperative to safeguard interests.

Role Essentials: Key Accountabilities:

• Define, develop, and enhance security processes and controls aligning with internal and external regulations/standards.
• Design, operate, and continually improve monitoring mechanisms to ensure compliance with internal security policies and relevant laws and regulations.
• Maintain ERP security policies and standards, ensuring adherence to current best practices.
• Ensure all SAP and other system changes comply with security policies, considering potential impacts on controls.
• Identify and remediate control “gaps” within systems and processes.
• Provide regular reporting to senior stakeholders on security, governance, and compliance, including access risk issues and mitigating control management.
• Embed a focus on security and controls into “business as usual” processes and implement periodic controls assurance programs.
• Monitor compliance with segregation-of-duties, sensitive access, and other security standards in SAP and other critical business systems using Security Weaver (now Pathlock) GRC tools.
• Review and approve risk mitigations along with Global Process Owners (GPOs).
• Collaborate with GPOs to ensure integration between business and IT controls.
• Act as a focal point for Security & Controls in relevant forums to advance ongoing controls initiatives and define/implement new ones.
• Coordinate and liaise with Internal and External Auditors during security audits.
• As an SME for Security & Controls, demonstrate security processes and GRC tool processes to internal and external auditors and respond to questions related to them.
• Provide expertise in additional security and controls capability, define requirements for solutions, and manage the delivery of enhancements.
• Provide oversight and audit support to ensure that security and controls services performed by outsourced providers align with policies and objectives.
• Perform reviews of new connections/interfaces into SAP and support new roadmap technology such as preparing for S4 HANA, and new Security Weaver (Pathlock) modules.
• Conduct forensic investigations as required to support the controls environment.

Essential Qualifications: A degree or equivalent qualification in an IT or engineering field or accounting would be preferable; relevant experience would also count.

Essential Technical and Professional Skills and Knowledge:

• Sound knowledge of SAP Security & Control standards and guidelines.
• Sound knowledge of SAP Security and Authorization technology across ECC, HCM, SRM, and BW.
• Thorough understanding of risk and control concepts, including IT general controls and business controls across key functional areas.
• Good troubleshooting & analytical skills, with excellent written and oral communication skills at both technical and business levels.
• Ability to work with people from different areas of the business and various levels of seniority to promote a controls-focused culture.
• Good understanding of GRC concepts, especially around access controls.
• Basic understanding of SAP workflow and approval controls.

Essential Experiences:

• At least 10 years of experience in ERP Security & Controls, with at least 7 years of experience in SAP Security Technologies.
• Experience with other SAP modules will be considered an advantage.
• Experience administering and/or using GRC technologies, with specific experience using Security Weaver (now Pathlock) preferable.
• Experience conducting audits or assurance programs around security and controls (preferable).