Governance and Authorisation Controller

Governance and Authorisation Controller

Permanent

Midrand

Overview

We are a Supply Chain and Sales & Merchandising partner adding value to your business through a fully integrated, temperature-controlled network in Southern Africa.

But we are also more than that. We are people serving people. While we boast the best in tech and infrastructure, our people are our greatest resource. With our skilled, curious, can-do people at the forefront, our assets become your assets, our service your solutions.

Vector's vehicle fleet includes a food industry first in 'multi-temperature' vehicles enabling the company to service business across frozen, chilled and ambient temperature zones on a single delivery.

Job Purpose

To understand risks exposed to the business if user access is not appropriately provisioned with the correct business role. To have a good understanding of business processes and be able to convert these to technical specifications.
To analyse business requirements of the group and configure business roles with the minimum amount of risk exposed to the group.
To develop with business risk mitigation and remediation strategies/controls for risk exposed by the business.
To manage user provisioning for access to systems across the group.
To develop & implement best practice governance processes for the group around the key IT & Financial systems.
To provide guidance and recommend best practices to the group for user access across all key IT & financial systems.

Key Responsibilities

Governance Risk and compliance (GRC)

Owner of the Governance Risk & Compliance systems application.Analyze and gain an understanding of the Group business requirements for the User Access Management, Emergency Access Management, Business Role Management and Access Risk Analysis.Applying the Business requirements of the Group to configuring the GRC application.Identify potential risk to the business for user access (segregation of duties) and business role development.Assessing, recommending and configuring financial and operational controls around all SAP and other ERP applications.Identify potential risk to the business for user access (segregation of duties) and business role development.Recommending mitigation and remediation strategies to business process owners to reduce risk exposure of the business.Preparing and constructing blueprints from best practices for security of systems to reduce risk exposure, Governance & Authorization Manager.Implementing authorized best practice strategies documented in Group blueprints in the GRC space.Manage relationships with internal and external stakeholders. Provide risk analysis reports to Internal and external audit.Liaise with internal audit to ensure that the controls designed and implemented are in line with Audit requirements.Owner of all external audit queries around user access and role management for key financial system.Assist Business Process Owners to understand key security and privacy issues, risks, exposures and vulnerabilities using workshops and assessments to develop security business needs.Identify identical or similar objects spread across the local systems for enabling best practice around building authorisations.

User Access

Administer and manage user provisioning and authorisations across the SAP and other ERP technology platforms and key IT Systems.Provide advisory services in terms of Information Security.Maintain access to securable SAP and other ERP resources.Troubleshoot and resolve security problems/failures for user access.Implement and document measures to safeguard the SAP and other ERP operating environments against accidental or unauthorized modification, destruction or disclosure.Analyse, categorise and resolve negative audit findings reported by internal or external auditors.Developing and updating access control tables for licences and groupings.Ensuring appropriate licence classifications are assigned to users thus preventing any additional costs the group may incur.Setting up user logon ids and assigning/resetting/revoking passwords and access.Develop best practice policies, procedures and standards, to ensure consistency in key system applications across the organisation.Perform normal and exceptional process of security authorization requests.Document information security standards and procedures relevant to the across the system applications for the group.Provide user statistics on respective systems (e.g. created users, deleted users, locked user, users not logged in 90 days).Understanding of and commitment to internal control.Assess risks and controls and identify, construct and implement opportunities for improvement.Act as both SAP and other ERP systems Security, providing troubleshooting and problem resolution while supporting the active user environment.Technicals approve user access for Vector Logistics systems access.Create exceptional requirements that business requires i.e. Developers for systems.Ensure that the risks associated with these requirements are mitigated.Custodian of Developer Keys in the SAP environment.Request and register custom developers and objects for development in the SAP environment.

Business Role and User Management

Develop, configure, and administer system Security components for all SAP and other ERP applications for the Group.Proactively engages in automating and streamlining of security and the appropriate control processes.Manage security administration, role design, and compliance for SAP and other ERP systems and other applications within the group.Developing good working relationships with other Managers, Architects and other Leads across the organization as well as external consultants, customers and auditors.Work with business owners to identify, define and document business roles.Convert business roles to technical roles.Build business/technical roles to meet with business requirements.Analyse and identify risk within these business roles.Provide guidance and recommend remediation/ mitigation controls for risk identified within business/technical roles.Redesign roles for remediation and advise on technical changes.Implement technical changes by building revised roles.Design, develop & document mitigations controls for business roles that have risk.Capture approved mitigations on the Governance Risk & Compliance (GRC) application.Monitor access to roles that have risk and advise control owners of the risk exposure.Investigate opportunities to improve system capabilities based on observed risks or gaps.Ensure timely reporting & remediation of security control gaps and vulnerabilities to the computing environment.Interfacing with members of Architecture, Infrastructure and Business Facing groups within the IT department & Business to develop solutions and troubleshooting issues.Run monthly risk analysis reports to identify risk exposure to the business.Responsible for the day-to-day security administration and maintenance including tasks such as creation of roles, profiles, IDs and assigning roles to users.

Additional Activities

Provide leadership, guidance and direction to the group for reducing risk exposed through user access & business role development by: Implementing best practice methods to other companies within the group for user access & business role development.Actively participate in initiatives to assist the group achieve objectives and reduce risk.Provide expert knowledge on best practice methods developed within other companies of the groupManage external consultants to achieve targets set.Support the business and technical IT with 24 hour 7 days a week technical access support to ERP and other applicationsSupport Internal Audit with sensitive transaction and access analysisSupport Internal Audit on sensitive investigations

Policy and Procedure Compliance

Technical design, development, testing, implementation, support, and documentation of system security around user access, business role management and risks within a SAP environment and other ERP systems.Work with various business and technical teams to build and maintain system security, participate in problem-solving, monitoring/resolving of technical incidents, researching and implementing best practice methods for role building, user access.Technical and team member for the IT Security within the group.Responsible for providing standards for system security.Provide guidance and direction to other team members and ensure the technical competency of the team is maintained.

Reporting

Provide reports, information and technical insight to business managers as and when required.Provide advisory services to other business entities.Provide information for monthly key performance indicators.

Team Coordination

Take ownership and accountability for tasks and activities and demonstrate effective self-management in terms of planning, prioritising and self-development.Responsible for the development and administration of user access rights on computer systems running SAP software and other ERP systems, advanced SAP software knowledge and a full understanding of security roles as they relate to SAP user profiles and other ERP systems, coaching staff on the understanding of security roles and SAP and other ERP systems software.Ensure the development of a future generation of leaders and specialist through mentorship and coaching.Support diversity within area of influenceFollow through to ensure that quality and productivity standards of work are consistently and accurately maintained.Inform relevant parties in the event of tasks or deadlines not met, the potential risks thereof and provide appropriate resolution.Support and drive the business core values.Manage colleagues and clients' expectations and communicate appropriately.Demonstrate willingness to help others and "go the extra mile" to meet team targets and objectives.Champion training and development of self through utilising available training opportunities or contributing to the development of new training solutions relating to product costing in collaboration with national training specialists.Participate in regular performance appraisals and ensure that own targets and goals are clear and achievable.

Key Relationships

Internal

All levels of staff & management.

External

Customers.Principals.Suppliers.Auditors.

Qualifications, Skills and Experience Required for the Job

Qualifications and Experience

Relevant IT/BCom degree or equivalent 3-year diploma.Demonstrates thorough knowledge of core financial modules, as well as GRC technology.Demonstrate thorough knowledge of the SAP authorisation concept.Demonstrates thorough knowledge of security and control (including configuration) for some of the SAP and SAP GRC applications and/or technologies.Demonstrates thorough knowledge of the design, implementation, and/or assessment of controls, including a significant understanding of the systems implementation lifecycle, including configuring and optimizing business process controls and application security.Experience as a SAP authorisation/GRC consultant would be an advantage

Skills and Competencies

Knowledge

Systems.
SAP (RCL , VECTOR, SUGAR instances).
MACs.
M-Tech (Agric and FMIM).
Format.
Agrigrain.
Group business processes.
Group business partners.
Segregation of duties conflicts.
Auditing of business processes.

Skills

Verbal and written communication.
Ability to multitask, effectively manage time & multiple projects.
High level interpersonal skills and influencing ability.
Fully operational understanding of SAP authorisation and other ERP systems concept and the GRC concept.
Drive & delivery focus.
Report writing.
Interpersonal.
Relationship management.
Logical thinking.
Analytical thinking.
Presentation.
Team commitment.
Leadership – ability to hold people accountable and manage staff.

We look forward to hearing from you

---