Director/Senior Director, Risk & Compliance

NBCUniversal•New York, NY

3d•$130,000 - $200,000•Hybrid

About The Position

NBCUniversal is seeking a Director/Senior Director, Risk & Compliance (R&C) to oversee technology-enabled risk management and internal controls for SAP S/4 HANA (S/4) and associated financial systems. This role will be instrumental in bridging the S/4 finance transformation implementation with post-go-live compliance and advisory functions. The position involves leadership in Security, Risk, and Controls (SRC), including assessing job-based security roles, segregation of duties (SoD), and process-level risks, as well as developing and maintaining a company-wide Risk & Control Matrix (RCM). The Director/Senior Director will collaborate with the S/4 project team, Global Controllership, Operations & Technology (O&T), and compliance groups to ensure risks are identified, mitigated, and controlled within the evolving financial systems landscape. Additionally, this role is responsible for establishing and managing a robust risk and compliance framework for Global Controllership and Global Finance Operations (GFO) teams, ensuring consistency with NBCUniversal’s policies, procedures, laws, and regulations. The GFO model includes Purchase to Payable (PTP), Order to Cash (OTC), and Record to Report (RTR) service towers, with a significant number of domestic and offshore team members serving various business groups globally.

Requirements

Bachelor’s degree in Accounting or Information Systems
12+ years experience preferably inclusive of internal / external audit and / or Big Four Public Accounting
Experience in internal controls, risk management, audit, or GRC, with significant exposure to SAP environments
Deep understanding of S/4 security roles, authorizations, and segregation of duties concepts
Proven experience developing and maintaining RCMs for complex finance processes and systems
Excellent knowledge of SOX and internal control frameworks including COSO, COBIT, generally accepted auditing standards, and accounting principles
Exceptional stakeholder engagement and communication skills
Experience with GRC tool implementation

Nice To Haves

CPA, CIA, and / or CISA professional certification
5+ years of relevant media industry experience
Experience driving change and influence within a matrixed and decentralized corporate environment
Experience supporting or leading risk and controls activities during an S/4 implementation or transformation
Experience with SAP GRC application (Access Control, Process Control, Risk Management). Strong understanding of SAP Fiori security and role design
Expertise in Business Process Controls (BPC), Segregation of Duties (SoD), and automated/manual controls in SAP
Proficiency in leveraging AI tools and technology

Responsibilities

Govern and work closely with Project Teams, GPOs, and O&T to develop and maintain the ongoing global access control strategy and role design standards
Help design and implement new roles that align with NBCU users’ job responsibilities
Design post-go-live approval workflows and set policy for access provisioning, role and transaction code changes, SoD risk mitigation, and periodic access and SoD rule set reviews
Act as the final design authority for critical and cross-functional / high-risk roles and help ensure SAP security design aligns with financial close, PTP, OTC, RTR control objectives, SOX compliance, and cyber, internal audit and external audit expectations
Identify, analyze, and remediate SoD risks / rule sets
Assess inherent and residual risks, with a focus on system-enabled risks and SoD exposures, and work directly with corporate / business units and process owners to understand end-to-end finance processes and mitigating SoD controls
Design and implement effective mitigating controls including transactional monitoring where preventive controls are not feasible, ensuring they are practical, sustainable, and auditable
Partner with IT, Security, and Cyber teams to ensure access controls align with business processes and internal control standards
Develop, maintain, and govern the Risk Control Matrix (RCM) for S/4 and finance-related boundary systems and consolidate with GFO RCM to ensure consistency and efficiencies
Ensure key risks and controls are effective, clearly documented, tested, embedded in the business, and updated as people, processes & technology change / evolve
Align the RCM with financial reporting, operational, and compliance requirements (e.g., SOX)
Develop a plan to maintain NBCU company-wide control framework post go-live including Governance Risk Compliance (GRC) tool evaluation and implementation
Perform risk assessment and develop compliance approach to help ensure processes and controls are operating effectively
Help identify roles and responsibilities during Keystone implementation and post go-live
Work closely with GPOs for all Finance areas including PTP, OTC, RTR, MDG and Reporting & Analytics
Serve as a trusted advisor to Global Controllership, Finance, O&T, and various compliance groups on risk and control matters
Liaison with internal audit, external audit, compliance, controllership, and finance leadership
Support audit activities, including walkthroughs, control testing, and remediation efforts related to S4 and boundary systems
Provide guidance during system enhancements, role redesigns, and process changes to proactively address risks
Facilitate updates to executive management and various stakeholders to help ensure timely communication and be responsible for applicable S/4 SRC go-live readiness sign-off
Establish standards and governance for access control reviews, control documentation, and risk assessments and develop SRC guidance and training as appropriate
Drive continuous improvement in risk awareness, control design, and documentation quality and utilize Artificial Intelligence (AI) and continuous control monitoring as applicable
Partner with Financial Technology Strategy Group as it relates to the technology evolution (i.e., AI, ML, Agentic AI) and impact on the control environment including embedding non-human processing and access into provisioning, access review, and SoD governance
Provide strategic thinking based on subject matter expertise (SME) for S/4 and boundary system data design and migration
Participate in Global Design workshops and interface with functional workstreams, the project leadership team, and solution integrators
Eloquently translate finance functional requirements to technical teams for development
Develop sustainable low maintenance solutions for system controls
Build stakeholder consensus and ensure everyone is on the same page, in agreement, and can understand the solution being proposed