Senior Principal Information Security Governance, Risk & Compliance Analyst

We need to produce HTML fragment with sections: About the role, Responsibilities, Requirements (maybe Qualifications), Benefits, Pay, Schedule? The posting includes Benefits & Compensation with salary range and benefits description. No schedule info. So include Benefits and Pay sections. Also maybe "Qualifications" includes Required Qualifications and Preferred Qualifications. Could combine into Requirements section. Also "Framework Knowledge" could be part of Preferred Qualifications. We need to preserve all substantive info, not invent. Remove boilerplate like application window line? The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. The line "We anticipate the application window for this opening will close on - 5 Oct 2026" is application instruction? It's about window closing; maybe considered application instruction, should be removed. Also "Physical Job Requirements" section includes generic statements; we need to see if it's substantive. It describes physical demands; might be considered boilerplate? It's not EEO but it's generic. Might be considered boilerplate; but it's part of job description. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. Physical Job Requirements is not those; but it's fairly generic. However we should preserve ALL substantive information; not invent or summarize away detail. The physical demands section is somewhat generic but still part of posting. I'd keep it maybe as a section "Physical Requirements". But the instruction says include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text. The physical demands section is generic but still content. Might be okay. We need to use

for section headings. Use

• for any list of duties/requirements/benefits, and

  for prose. We need to output only HTML fragment. Let's structure:

  About the Role

  ... prose from About The Role paragraph(s).

  Then Responsibilities: we have many bullet-like paragraphs each starting with a bold heading? Actually the responsibilities are listed with headings like "Access Governance & Segregation of Duties", "User Access Review & Privileged Access Governance", etc. Each has multiple sentences. We could treat each as a subsection? But instruction: Use
  • for any list of duties/requirements/benefits. So we could make a
    where each
    • contains the responsibility block (maybe with internal

      or ). Simpler: each responsibility heading as

    • with its content. We need to preserve all substantive info. So we will extract each responsibility block. Let's copy the text: Access Governance & Segregation of Duties Coordinate and support enterprise Segregation of Duties governance across SAP and other key enterprise platforms. Administer SAP GRC Access Control capabilities, including Access Risk Analysis, Access Request Management, Emergency Access Management, and Business Role Management. Maintain SoD rulesets, risk functions, mitigating controls, access governance documentation, and related control evidence. Assess access risks, including SoD conflicts, excessive entitlements, privileged access exposure, and control effectiveness concerns. Monitor access-related exceptions, remediation plans, compensating controls, metrics, and trends to support risk reduction and compliance obligations. Partner with application owners, IAM, SAP Security, and business stakeholders to evaluate and address identified access governance risks. User Access Review & Privileged Access Governance Coordinate and manage periodic User Access Reviews and access certification activities. Monitor completion rates, overdue certifications, and non-compliance issues in accordance with governance requirements. Support oversight of privileged access, emergency access, Firefighter governance, and related monitoring activities. Review privileged access activity and maintain evidence supporting user access governance controls. SOX ITGC Compliance & Control Monitoring Administer and support SAP GRC Process Control activities used to monitor, assess, and validate SOX IT General Controls and security compliance requirements. Support SOX ITGC compliance execution, control monitoring, audit evidence collection, validation, retention, and reporting. Assist control owners and stakeholders with control procedures, evidence requirements, deficiencies, findings, remediation tracking, and closure activities. Develop dashboards, metrics, and reporting to support management self-assessment, continuous control monitoring, and control effectiveness improvements. Audit & Assurance Support Support internal audits, external audits, and regulatory assessments by coordinating evidence, documentation, walkthroughs, and audit responses. Maintain audit-ready documentation repositories and supporting records. Monitor remediation activities and validate completion of corrective actions. Perform control assurance activities by reviewing evidence completeness, control execution, and remediation effectiveness. Governance & Compliance Operations Support the development, implementation, and maintenance of information security policies, standards, procedures, governance processes, and control frameworks. Support control inventory management, exception management, compliance reporting, GRC tool administration, workflows, dashboards, and reporting capabilities. Develop compliance and risk metrics to monitor program effectiveness and identify opportunities for process improvement, automation, and control optimization. Contribute to scalable governance standards, operational procedures, and compliance monitoring practices that strengthen enterprise security governance. Risk Management Support Assess cybersecurity, technology, artificial intelligence, data protection, and operational risks through structured risk assessment and governance processes. Facilitate information security risk assessments supporting governance, compliance, and enterprise risk management activities. Maintain risk registers, treatment plans, issue logs, action tracking, KRIs, risk dashboards, and management reporting. Evaluate mitigation strategies and control implementation activities to support informed business and technology decision-making. Stakeholder Collaboration & Advisory Support Partner with Information Security, Information Technology, Finance, Privacy, Internal Audit, Legal, Enterprise Risk Management, and business stakeholders. Translate technical risks, access governance issues, and compliance requirements into clear, business-focused recommendations. Facilitate assessments, workshops, compliance reviews, and cross-functional discussions to promote risk-informed decision-making. Provide subject matter guidance on governance, compliance, access governance, risk management, and security control requirements. Second-Line Independence & Governance Boundaries This role provides oversight, monitoring, reporting, governance, compliance, risk management, and assurance activities while maintaining appropriate second-line independence. The role partners with first-line teams to evaluate control design, monitor execution, assess risk, validate evidence, and support remediation governance while preserving independent oversight responsibilities. Now Required Qualifications: list. We can make a
      for Required Qualifications and another for Preferred Qualifications, maybe under a single Requirements section with subheadings? But instruction: use

      for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we could have a section

      Requirements

      and inside we can have

      or

      . Could also have

      Qualifications

      . The list includes Required Qualifications and Preferred Qualifications. Could combine under Requirements. We'll output:

      About the Role

      ... (the paragraph)

      Responsibilities

      • Access Governance & Segregation of Duties ...
      ...

      Requirements

      Required Qualifications

      • Bachelor’s degree in Information Security, Cybersecurity, Information Systems, Risk Management, Business Administration, Accounting, Finance, Audit, or a related discipline, or equivalent combination of education and experience.
      • Minimum 10 years of experience in Information Security GRC, Information Security Risk Management, SOX ITGC Compliance, Internal Audit, External Audit, Access Governance, Identity Governance, SAP Security Governance, Compliance Management, or Internal Controls Management.
      • Requires advanced knowledge of Information Security GRC, access governance, regulatory compliance, risk management, and internal controls.
      • Requires strong understanding of SAP GRC Access Control and SAP GRC Process Control administration.
      • Typically obtained through advanced education combined with significant professional experience in information security, compliance, governance, risk management, audit, or internal controls.
      • Current SAP Certified Application Associate, SAP Access Control certification required.
      • Current SAP GRC Process Control certification required.

      Preferred Qualifications

      • Hands-on experience administering SAP GRC capabilities supporting SoD, UAR, EAM, SOX ITGC, continuous control monitoring, compliance reporting, and audit evidence management.
      • Experience administering SAP GRC Access Risk Analysis, Access Request Management, Emergency Access Management, Business Role Management, and SAP GRC Process Control.
      • Experience maintaining SoD rulesets, mitigating controls, access-risk libraries, access review campaigns, compliance dashboards, and audit evidence repositories.
      • Experience supporting SOX ITGC testing, walkthroughs, evidence requests, remediation tracking, and audit readiness activities.
      • Working knowledge of SAP authorization concepts, including roles, profiles, transaction codes, and role-based access controls.
      • Strong analytical, documentation, reporting, stakeholder management, and business communication skills.
      • SAP GRC Risk Management Certification or experience administering SAP GRC Risk Management solutions.
      • Professional certifications such as CISA, CRISC, CIA, CISM, CISSP, GRCP, or CPA.
      • Experience supporting public-company SOX 404 compliance programs.
      • Experience in medical device, healthcare, life sciences, pharmaceutical, manufacturing, or other highly regulated industries.
      • Experience supporting enterprise access governance platforms beyond SAP, including Oracle, Workday, ServiceNow, SailPoint, Entra ID, or comparable platforms.
      Maybe also Framework Knowledge as part of Preferred? Could add a bullet: "Knowledge of one or more of the following frameworks and standards is preferred: NIST Cybersecurity Framework, NIST Risk Management Framework, NIST AI Risk Management Framework, ISO 27001, ISO 31000, ISO 42001, COBIT, COSO Internal Control Framework, SOX 404 IT General Controls, HIPAA Security and Privacy Requirements, Data Protection and Privacy Regulations." Add that as a bullet. Now Benefits & Compensation: we need Benefits and Pay sections. We have Benefits description: "MiniMed offers a competitive salary and flexible benefits package ... Regular employees working 20 or more hours per week are eligible for a robust benefits package, including health, dental, and vision insurance, as well as access to a Health Savings Account, Healthcare Flexible Spending Account, life insurance, long-term disability leave, and a dependent daycare spending account. In addition, all regular employees enjoy incentive plans, a 401(k) plan with company match, short-term ..." The text cuts off at "short-term". We need to preserve all substantive information; we have incomplete sentence due to cutoff. We'll include what we have. Pay: Salary ranges: "Salary ranges for U.S (excl. PR) locations (USD):150,000.00 - $256,000.00 For roles located in California, Seattle WA, Washington DC, Boston MA, and New York City, the salary range is $150,000.00 - $256,000.00 USD. Actual compensation may vary based on factors including experience, education, certifications, skills, market conditions, internal equity, and geographic location. Compensation and benefits information pertains solely to candidates hired within the United States (local market compensation and benefits will apply for others)." We'll make a Benefits section with
      of benefits items. Pay section with

      describing salary range. Schedule: none, so omit. Physical Job Requirements: we could include a section

      Physical Requirements

      with the prose. But it's generic; but we should preserve. Let's include. Now ensure we removed boilerplate like "We anticipate the application window..." and "Physical Job Requirements The above statements are intended