Director - Information Services, Compliance

Responsibilities

Lead the IT/IS compliance program, including governance, control design, metrics, reporting.

Primary IT compliance interface with external audit technical partner and staff.

Assess SAP and IT risks in a hands-on leadership role with direct accountability for the appropriate design of key controls (including SOX-relevant ITGC/application controls).

Actively engage in control design, testing strategy, evidence review, and manage ongoing control performance and testing.

Serve as a key partner to SAP Security to ensure effective access controls, including user/role design and analysis (authorization objects), sensitive access, segregation of duties, and Fiori access considerations.

Own SAP Governance, Risk, and Compliance (GRC) processes for Access Risk Analysis and Emergency Access Management, including evidence standards and control testing support.

Coordinate internal and external audits (including SOX) and manage walkthroughs, evidence collection, remediation plans, and closure validation.

Partner with SAP Basis and SAP Development on change governance (transports, configurations, break-fix) to ensure controls are built into delivery and operations.

Partner with SAP Functional/Technical and business teams to understand end-to-end processes and integration points (including FI) and their impact on financial reporting controls.

Maintain SAP compliance documentation (policies, procedures, narratives, flow/architecture documentation as needed) and a controls inventory/testing calendar.

Support SAP Global Trade Compliance (GTC) and related compliance reporting processes; ensure control objectives are understood and testable.

Drive readiness and control design for SAP implementations and major releases.

Coordinate FI reporting system controls and integrations (MS BI a plus), and support SAP licensing and audit activities.

Qualifications

Formal Education & Certification Bachelor’s degree in information systems, Computer Science, Accounting, or a related field, or equivalent experience.

8+ years of progressive experience in IT risk, IT audit, cybersecurity compliance, or technology controls.

One or more relevant certifications preferred (e.g., CISA, CISSP, CISM, CRISC, CPA).

Demonstrated experience leading SAP IT/IS SOX compliance in a US public company (risk assessments, control design, control performance, testing, and audit management) with strong understanding of GRC concepts.

A strong mix of the following skills within the SAP S/4 HANA platform:

• SAP Security (Expert): user/role analysis (authorization objects), sensitive access, segregation of duties, and Fiori access considerations.
• SAP GRC (Expert): Access Risk Analysis and Emergency Access Management.
• SAP GTC (Good understanding): Compliance module concepts and control expectations.
• SAP Basis / Development (Good understanding): platform operations and change delivery processes.
• SAP Functional Modules (Good understanding): SAP business processes; configuration experience in at least one key module; integration with FI and impact on financial reporting.
• FI reporting systems (Good understanding): architecture, integration points, and common controls (MS BI, SAP Group Reporting a plus).
• SAP implementation experience highly desired (two or more implementation cycles preferred).
• SAP licensing and audit experience.
• Designing and operating controls for SAP ERP systems (ECC or S/4HANA), Microsoft 365/Azure, Active Directory, and major enterprise applications.
• Demonstrated ability to translate regulatory/control requirements into practical, sustainable processes within an IT operating environment.
• Partnering with cross-functional teams to remediate control gaps and improve processes without disrupting business operations.
• Excellent documentation skills, including procedures, narratives, evidence standards, and audit-ready artifacts.
• Comfort working with ambiguity and driving structured execution across multiple stakeholders and locations.

Personal Attributes

Highly organized, detail-oriented, and able to manage multiple audits and stakeholders.

Clear communicator who can translate technical controls into business-ready guidance.

Influences without authority and drives timely remediation and accountability.