Security and Compliance Expert, ERP Data Platform

Roche Digital Technology (RDT) is a global team at the heart of Roche dedicated to powering the company through cutting-edge digital technologies including artificial intelligence, data, and scalable tech innovations in healthcare. The position is based in Warsaw with additional locations in Madrid, Poznan, and Pune.

• Bachelor's Degree in Computer Science, IT, or Engineering with a minimum of 5 years' post-secondary experience in SAP Security and Compliance.
• Proven experience as a Subject Matter Expert (SME) for ICFR, GxP, and GRC environments.
• Working knowledge of SAP BW, HANA Studio, SAP BI, and SAP Datasphere, and familiarity with SAP Analytics and AI trends.
• Strong understanding of Segregation of Duties (SoDs), Critical access, Access Controls, and pharmaceutical industry SAP audit guidelines.
• Experience with Data Products and Data Governance principles.
• Skilled in IT system validation processes, System Risk Assessments, and Data Privacy requirements.
• Strong analytical skills in root cause analysis and remediation.
• Experience managing external workforces in an Agile (SAFe/Scrum) environment.
• Proficiency in English with excellent interpersonal and training skills.
• Ability to quickly learn new technologies and compliance frameworks in a regulated global organization.

• Implement and maintain security, authorization, and compliance standards for SAP platforms (SAP BW 7.5 HANA, SAP BW4HANA, SAP Datasphere).
• Monitor relevant regulations such as GDPR, CCPA, HIPAA, and SOX, and industry standards including ISO 27001, SOC 2, and NIST.
• Drive creation and refinement of internal policies and data governance frameworks.
• Act as System Owner Deputy and Control Owner for ICFR lifecycle, GxP controls, and other regulations.
• Lead monitoring of Segregation of Duties (SoD) conflicts via GRC dashboards and mitigate risks.
• Oversee application error reviews and sign off monitoring results in tools like ICAt.
• Perform quarterly reviews of Critical access, GRC FireFighter roles, and HANA DB users to maintain least privilege.
• Lead ICFR IT audit support and act as primary contact for auditors during peak cycles.
• Set technological directions focusing on data governance, validation, and automation.
• Annually review and update System Risk Assessment (SRA) and Data Classification.
• Conduct innovation projects to optimize processes and increase efficiency through automation.
• Collaborate with system teams and stakeholders to ensure task ownership, bridge data privacy awareness, and train new team members.

The role requires hybrid work with employees in the Warsaw office on average two days per week. English proficiency is mandatory. Data protection and personal data processing comply with Roche Polska Sp. z o.o. policies. Roche is an Equal Opportunity Employer.