Karolina Anszczak

S4 transformation GRC adminstration&configuration

1. SAP GRC pre-deployment configuration 2. Creating and maintaining SAP GRC specific processes 3. Managing adherence to the access controls and process controls framework on a hub-by-hub basis 4. Working closely with Functional Teams and Technical Teams as well as the business and off-shore support teams to ensure the following: • Segregation of Duties (SOD) and critical actions are understood and appropriately built into the roles • application security standards are well integrated into systems by incorporating SOD testing into the security process 5. Monitoring and maintaining SAP application security policies, standards, guidelines and procedures that are in alignment with the corporate strategic plan 6. Supporting Project Teams during the implementation 7. Responsible for implementation and integration of SAP GRC SOD and other post go-live sustainment tools 8. Working with business managers in refining risk and mitigating controls 9. Supporting / educating business teams on risks and proposed mitigating controls 10. Understanding and defining compliance related issues as it relates to SAP roles

1. SAP GRC pre-deployment configuration 2. Creating and maintaining SAP GRC specific processes 3. Managing adherence to the access controls and process controls framework on a hub-by-hub basis 4. Working closely with Functional Teams and Technical Teams as well as the business and off-shore support teams to ensure the following: • Segregation of Duties (SOD) and critical actions are understood and appropriately built into the roles • application security standards are well integrated into systems by incorporating SOD testing into the security process 5. Monitoring and maintaining SAP application security policies, standards, guidelines and procedures that are in alignment with the corporate strategic plan 6. Supporting Project Teams during the implementation 7. Responsible for implementation and integration of SAP GRC SOD and other post go-live sustainment tools 8. Working with business managers in refining risk and mitigating controls 9. Supporting / educating business teams on risks and proposed mitigating controls 10. Understanding and defining compliance related issues as it relates to SAP roles

1. Monthly SAP GRC usage - SOD and SOX-HIGH audit checks, 2. Run GRC reports to control level of risk in systems, 3. Create/Update/Delete Role Owners (Primary/Backup) for GRC, 4. Manage User Access Review Rejections & Removals for all roles, 5. Maintain access control owners (role owner, mitigating control monitors), 6. Create/Update/Maintain Mitigating Controls Monitors (including user mitigation), 7. Initiate Identify/Confirm Role Owners and Backups (Annually), 8. SAP GRC FireFighter usage approval status monitoring and delivering regular reports, 9. Monthly HR Reconciliations - regular checks based on HCM report, Service Now and SAP checks, 10. Monitor compliance to policies and procedures relating to accuracy, integrity, confidentiality and security, 11. Answering IT Control questions and proposes solutions, 12. Inform management on information security events and control related compliance issues, 13. Monthly SAP IDM usage - user checks, basic problem solutions, reporting to IDM team about found issues, 14. SAP Custom transaction review process for GRC Ruleset update, 15. Prepare, manage, update and execute a monitoring strategy for various Cycles in different units – based SAP Enterprise Content Management templates, 16. Monitoring of compliance issues using vulnerability management tool (Qualys), 17. Proxy monitoring and report creation (MissionControl software), 18. Conduct tracking and maintain checklists using several help desk ticket applications to provide follow-up and evidence of completed IT controls and security monitoring activities, 19. Configure and maintain global alert and notification systems supporting local business units performing security event and monitoring activities, 20. Participate on committees relating to system and data security, 21. Respond to security breaches and participate in investigations amd root-cause analysis that helps protect, detour and avoid against future event.

- Data protection audits, - Preparation of post-audit reports and recommendations for clients, - Conducting data protection trainings for clients, - Preparing and analyzing trade agreements.