SAP SOX Compliance professional

Job description

• Role Summary-We are looking for a SAP SOX Compliance professional with 23 years of experience supporting SOX 404 compliance for SAP landscapes. The role focuses on SAP IT General Controls (ITGC) and automated/application controls, including user access management, segregation of duties (SoD), and change management controls. You will work with SAP Security, Basis, and business process owners to ensure controls are designed, executed, evidenced, and audit-ready, while partnering with internal/external auditors to support walkthroughs
• and testing.

Key Responsibilities

• SOX Compliance & Control Operations (SAP Focus) Support SOX 404 compliance activities for SAP systems (e.g., S/4HANA,PI/PO, BPC, Ariba, SailPoint). Execute and coordinate SAP ITGCs, including: User Access Controls: provisioning, modification, de provisioning, emergency accesso SoD Controls: SoD analysis, mitigation controls, remediation track in go Change Management Controls: transport approvals, testing evidence, migration control so IT Operations Controls: backup/restore, job monitoring, incident/problem management (where applicable) Assist with control design, updates, and documentation (process narratives, control descriptions, RCMs, test scripts, SOPs).
• Audit Support & Evidence Management Act as the primary coordinator for SAP-related SOX audits :o Collect, validate, and organize audit evidence (screenshots, logs ,approvals, tickets, access listings).o Support walkthroughs, inquiries, and sample-based testing with internal/external auditors. Track audit requests and ensure timely responses; maintain evidence repositories and version control.
• SAP Access & Security Governance Support SAP Security teams on :o Role design review (single/composite roles), authorization object considerations (high-level)o Access recertification campaigns (UAR), privileged access monitoring Participate in periodic reviews :o Firefighter/Emergency Access usage review (where tools like SailPoint, SAP GRC EAM are used)o Critical transaction/code reviews and sensitive access monitoring
• Issue Management & Remediation Log control exceptions, coordinate remediation plans, and track closure dates. Assist in root cause analysis for recurring deficiencies and suggest control improvements. Contribute to continuous improvement initiatives for automating evidence ,standardizing control execution, and reducing audit effort.
• 5) Stakeholder Collaboration Work closely with SAP Security, Basis, Change/Release teams, Finance/Process owners, and IT governance. Communicate control requirements clearly and proactively manage dependencies and timelines.

Required Experience &

Qualifications 23 years of hands-on experience in SOX compliance / IT audit / IT controls testing, with SAP exposure. Practical knowledge of SOX ITGC domains, especially :o Access provisioning & de provision in go SoD concepts and risk manage mento Change management / transport controls Experience working with auditors and managing evidence collection and walk throughs. Familiarity with common audit/testing artifacts (tickets, approvals, access logs, transport logs, configuration screenshots). Strong documentation skills (RCM updates, narratives, procedures) and attention to detail.