Digital Risk Solutions Senior Associate

Pwc Canada

2d • Hybrid

About The Position

A career in our Enterprise Technology Risk Solutions practice, within the Risk Services team, will provide you with the opportunity to assist clients to better leverage enterprise technologies to drive a higher return on investment and improve risk management. Using advanced technology, we’re able to focus on establishing the right controls, processes and structures for our clients to ensure that verdicts are based on accurate information and assure that information provided to third parties is accurate, complete, and can be trusted. Our team helps business leaders develop into data driven organizations that adopt a comprehensive evidence based strategy, combined with the execution support to deliver results. You’ll focus on finding value and enabling sustainable information performance by using data, tools, analytics, complex modeling, data visualization, simulation, economics, optimization, information management, business intelligence, and industry expertise. As part of this mission, we are seeking to hire an experienced SAP Security and GRC Consultant to strengthen our Enterprise Technology Risk Solutions practice. This role will focus on designing, implementing, and supporting SAP Security and Governance, Risk, and Compliance solutions across complex SAP landscapes, including S/4HANA. The consultant will work closely with clients to establish robust access controls, mitigate technology and compliance risks, and embed security by design into enterprise systems, enabling trusted, compliant, and data‑driven decision-making.
The Opportunity:
As a Digital Risk Solutions Senior Associate, unlock your potential and embrace the chance to drive meaningful outcomes that’ll elevate your career. Your role will include, but isn’t limited to:
Work on large-scale technology transformation projects across end-to-end SAP transformations
Provide risk advisory services to clients in key technology areas such as SAP S/4 HANA, BTP Security, IAG, SuccessFactors, Ariba, SAP Governance, Risk and Compliance (GRC), primarily focused on:
Design SAP Security and SAP GRC frameworks from the ground up in greenfield and brownfield S/4HANA implementations
Implement end‑to‑end SAP security design, including: Role concept and role naming standards, Authorization object design and access strategy and Fiori catalog, group, and role design
Technically build SAP S/4HANA roles as per the design and approach established
Address any access issues / authorization issues identified during implementation phase.
Perform security assessments on the role design of the client system and provide recommendation or remediations suggestion.
Define, configure, and implement process control and risk management modules of SAP GRC.
Design and develop SAP BTP security (role collection) and integrating IAG with on premise SAP GRC.
Configure and integrate on premise SAP GRC to IAG bridge to cater to hybrid SAP landscape.
Experience supporting audits, access reviews, and control testing is an added asset Ability to balance security, compliance, and business enablement
Ability to balance security, compliance, and business enablement
Clear communication with technical, functional, and business stakeholders
Bring strong leadership and project management skills to engagement teams, working in dynamic and cross-functional teams for large-scale and multi-national engagements
Define, configure, and implement SAP GRC Access Control aligned to the target SAP landscape, including:
Access Request Management (ARM): Design and configure end‑to‑end access request processes, including workflow design, MSMP configuration, BRF plus rules, user access provisioning, and Segregation of Duties (SoD) check stages
Access Risk Analysis (ARA): Configure ARA framework, including risk ruleset design and customization, definition of Segregation of Duties (SoD) frameworks, and development of mitigation strategies
Emergency Access Management (EAM): Configure the EAM module and design Firefighter processes to ensure controlled and auditable emergency access
Business Role Management (BRM): Design and configure BRM to support role lifecycle management and alignment with target role design standards

Requirements

• Bachelor’s or Master's degree in Business, Information Technology, Finance, Data Science or Computer Science degree required
• Strong hands‑on expertise in SAP S/4HANA Security, Fiori Security, and SAP GRC access control are required
• Deep understanding of SAP’s Segregation of Duties (SoD), internal controls, and compliance requirements (e.g., SOX)
• Relevant experience, including key areas such as Consulting (e.g. SAP S/4HANA implementation, BTP security configuration, IAG implementation, project management, IT consulting, risk consulting, cyber security, etc.), Assurance (internal and/or external audit) or relevant industry roles (e.g. risk management, IT, cyber security, finance and accounting, project management, system implementation)
• Business development: getting involved with new opportunities, taking a proactive role in raising awareness of the firm's services and level of commitment to the local market, developing and maturing relationships with internal staff and clients, developing proposals, identifying and pursuing opportunities to increase the practice's penetration in the public and private sector
• Provide high performance (e.g. clear vision/target/purpose, open communication, promoting flexibility, collaboration and accountability) to deliver high quality to clients and a rewarding experience to staff.
• A demonstrated commitment to valuing differences and working alongside diverse people and perspectives

Nice To Haves

• Experience and knowledge of controls integration, security design/implementation and GRC integration related to SAP S/4 HANA, SuccessFactors, BTP, workzone, Ariba, SAP GRC process control and risk management modules are an asset.
• Completion of relevant certifications (e.g. CISSP, PMP, CRISC, CISM or CISA designation) is an asset
• Certifications from SAP (e.g. SAP S/4 HANA, BTP administrator, SuccessFactors, Ariba, SAP Governance, Risk and Compliance (GRC)) is an asset.
• Implementation and configuration experience on process control and risk management modules of SAP GRC is highly appreciable.

Responsibilities

• Work on large-scale technology transformation projects across end-to-end SAP transformations
• Provide risk advisory services to clients in key technology areas such as SAP S/4 HANA, BTP Security, IAG, SuccessFactors, Ariba, SAP Governance, Risk and Compliance (GRC)
• Design SAP Security and SAP GRC frameworks from the ground up in greenfield and brownfield S/4HANA implementations
• Implement end‑to‑end SAP security design, including: Role concept and role naming standards, Authorization object design and access strategy and Fiori catalog, group, and role design
• Technically build SAP S/4HANA roles as per the design and approach established
• Address any access issues / authorization issues identified during implementation phase.
• Perform security assessments on the role design of the client system and provide recommendation or remediations suggestion.
• Define, configure, and implement process control and risk management modules of SAP GRC.
• Design and develop SAP BTP security (role collection) and integrating IAG with on premise SAP GRC.
• Configure and integrate on premise SAP GRC to IAG bridge to cater to hybrid SAP landscape.
• Experience supporting audits, access reviews, and control testing is an added asset
• Ability to balance security, compliance, and business enablement
• Clear communication with technical, functional, and business stakeholders
• Bring strong leadership and project management skills to engagement teams, working in dynamic and cross-functional teams for large-scale and multi-national engagements
• Define, configure, and implement SAP GRC Access Control aligned to the target SAP landscape, including: Access Request Management (ARM): Design and configure end‑to‑end access request processes, including workflow design, MSMP configuration, BRF plus rules, user access provisioning, and Segregation of Duties (SoD) check stages
• Access Risk Analysis (ARA): Configure ARA framework, including risk ruleset design and customization, definition of Segregation of Duties (SoD) frameworks, and development of mitigation strategies
• Emergency Access Management (EAM): Configure the EAM module and design Firefighter processes to ensure controlled and auditable emergency access
• Business Role Management (BRM): Design and configure BRM to support role lifecycle management and alignment with target role design standards

Benefits

• inclusive benefits
• flexibility programs

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Number of Employees: 5,001-10,000 employees