SAP GRC Architect & Lead Consultant

• Minimum 8-10 years of experience focused exclusively on the SAP GRC suite.
• Having led as a Principal Consultant / Architect at least 3 complete end-to-end implementation projects involving both SAP GRC Process Control and SAP GRC Risk Management.
• Demonstrable technical integration experience between the GRC platform (PC/RM) and the SAP Audit Management module (details of the architecture implemented in previous projects will be requested during the interview).

• Official SAP certification: SAP Certified Application Associate - SAP GRC Risk Management or SAP GRC Process Control.
• Industry certifications in Governance and Risk (desirable): CISA (Certified Information Systems Auditor), CRISC (Certified in Risk and Information Systems Control), or similar.

At Métrica, we are looking for an SAP GRC Architect & Lead Consultant (Process Control, Risk Management, and SAP Audit Management) with at least 8 years of experience for a technology project.

The selected candidate will act as Technical and Functional Lead for the design, configuration, deployment, and stabilization of the SAP GRC Process Control (PC) and SAP GRC Risk Management (RM) modules.

Their critical objective is to model a robust architecture that not only automates internal control and risk management but also integrates natively and bidirectionally with the SAP Audit Management system already operational in the organization, allowing audit findings to feed the risk map and controls automatically.

SAP GRC Process Control (PC) – Automation and Internal Control

The expert must demonstrate the ability to configure the complete control cycle:

• Internal Control Structure: Configuration of the Control Organization, Central and Local Business Processes, and associated Master Data via MDUG.
• Continuous Control Monitoring (CCM - Continuous Control Monitoring):
• Full configuration of Automatic and Semi-automatic Controls.
• Design and parameterization of Data Sources and Business Rules under CCM submodule methodologies (Configurable, Scheduled, or via SAP Query / SAP BW / HANA Views).
• Automation of control effectiveness testing (Automated Control Testing) and automated exception generation.
• Deployment of Out Of The Box (OOTB) controls in different ABAP environments.
• Manual activity workflows: Configuration of design self-assessment and operational control effectiveness flows through dynamic forms and questionnaires.
• Issue Management: Automation of the findings lifecycle, from the triggering of the deficiency and assignment of the remediation plan, to the retesting of the control.

SAP GRC Risk Management (RM) – Advanced Risk Architecture

The expert must lead the definition and configuration of:

• Risk Governance and taxonomy: Configuration of the risk category structure, impact factors, risk velocity, and time horizons.
• Risk Modeling: Configuration of qualitative, quantitative, and semi-quantitative assessment methodologies (Impact and Probability Matrices / customized Heat Maps).
• Response and Mitigation Management: Linking action plans and risk responses directly to the mitigating controls stored in Process Control.

The candidate must not view the modules in isolation. Real experience is required in:

• Object Synchronization: Linking audit universes with the organizations, risks (RM), and controls (PC) of the global GRC system.
• Findings Flow (Findings to Issues): Configuration so that deficiencies or observations detected during an audit in SAP Audit Management travel automatically as "Issues" or deficiencies to SAP Process Control for remediation, or impact the risk score in SAP Risk Management.
• Shared Master Data: Ensuring the consistency of the risk and control catalog so that internal auditors execute their workpapers directly against the live baseline configured by the internal control area.

Technical Framework and Transversal Layer (Standard Basis/Development)

• Advanced Workflow (MSMP & BRFplus): Full modeling of multi-level approval flows for risks, controls, action plans, and exceptions. Creation of complex business rules in BRFplus (Boolean, decision tables) for dynamic workflow routing.
• Interactive Forms (Adobe Forms / PDFs): Customization and deployment of interactive PDFs integrated into the standard for offline/online collection of risk assessments, signatures, and control attestations.
• User Interface (UI) and Portals: Customization of screens through the standard suite (Web Dynpro ABAP, customization of mandatory/visible fields, configuration of specific dashboards by user role).
• Full Standard Reporting: Configuration of the GRC Dashboard, integrated analytical reports, and Crystal Reports / SAP Lumira / Fiori Analytic Apps embedded in the GRC solutions standard.

• Deep understanding of the SAP GRC table architecture (tables /GRCPI/*, GRFN*, GRRM*, GRPC*) for resolving data inconsistencies and optimizing Data Sources.
• Knowledge of Internal Control methodologies (COSO, SOX, ISO 31000) to speak the same language as the company's Risk and Audit Directors.
• Business-to-Technology Translation Capacity: Ability to sit with the Risk Director or Audit Leader, understand their risk matrices in Excel, and transform them into an automated architecture in SAP without altering the software standard or by modifying it as little as possible.
• Autonomous Leadership: The consultant will operate as an independent subcontractor; they must be able to self-manage, propose the technical roadmap, and defend SAP best practices against user requests for custom developments.
• Inspiring Technical Confidence: Ability to communicate fluently with both the systems infrastructure team (Basis/Security) and the Audit Committees/Compliance team.