Cybersecurity GRC Analyst, SAP Platform

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve - we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

At McKesson, we are advancing healthcare through innovation, integrity, and operational excellence. We are seeking an experienced Cybersecurity GRC Analyst, SAP Platform to support and strengthen our Governance, Risk, and Compliance (GRC) program. In this role, you will help ensure compliance with regulatory and internal control requirements while improving risk management processes across the enterprise.

You will partner with business, security, audit, and technology teams to implement and maintain effective controls, manage SAP GRC solutions, and support audit readiness. This role is ideal for a professional who combines strong technical expertise with a passion for compliance, risk reduction, and continuous improvement.

What You'll Do

• Administer and support the SAP GRC Suite, including Access Control, Process Control, and Risk Management.
• Perform Segregation of Duties (SoD) analysis, identify conflicts, and partner with stakeholders on remediation activities.
• Lead User Access Reviews (UARs) and support Privileged Access Monitoring to ensure appropriate system access.
• Execute and document ITGC and SOX control testing, maintaining audit-ready evidence and compliance documentation.
• Support internal and external audits by providing evidence, responding to inquiries, and tracking remediation activities.
• Conduct risk assessments and control reviews to identify gaps and recommend improvements.
• Monitor control effectiveness, compliance metrics, and reporting to support leadership decision-making.
• Partner with cross-functional teams to strengthen governance, risk, compliance, and security practices across the organization.

Basic Requirements

• 4+ years of experience in SAP GRC, IT risk, compliance, IT audit, cybersecurity governance, or related fields.
• Bachelor's degree in Information Systems, Information Security, Risk Management, Accounting, Business, or a related discipline; or equivalent experience.
• Hands-on experience with SAP GRC Access Control, Process Control, or Risk Management.
• Experience performing Segregation of Duties (SoD) analysis and remediation.
• Experience conducting User Access Reviews and access governance activities.
• Experience supporting SOX compliance, ITGC testing, and audit documentation.
• Strong understanding of risk management, internal controls, and compliance frameworks.
• Strong analytical, communication, and stakeholder management skills.

Technical Skills and Key Experience Areas

• SAP Basis, HANA/Oracle/MSSQL DBA, Business Objects, Linux and Windows administration.
• Platform experience across SAP RISE, SAP BTP, and other SAP SaaS deployments.
• Hyperscaler platform experience including Microsoft Azure and GCP.
• Advanced Identity and Access Management (SSO/MFA) leveraging OpenID, SAML, Kerberos, SPNego, LDAP, Active Directory, Okta, and SAP Identity Provider.
• Privileged Access Management across OS, database, and application layers in SAP and non-SAP environments, including CyberArk.
• IGA, SAP GRC, and SailPoint expertise.
• SOX/SOC controls across OS, database, and application layers in SAP and non-SAP environments.

Preferred Skills/Experience

• SAP security administration experience within ECC, S/4HANA, or cloud environments.
• Knowledge of Privileged Access Management (PAM) concepts and monitoring practices.
• Experience supporting regulatory, internal, or external audits.
• Familiarity with automated controls monitoring and compliance reporting tools.
• Experience developing compliance dashboards, metrics, and management reporting.
• Professional certifications such as CISA, CRISC, CISSP, SAP GRC, or similar.
• Experience driving control-gap remediation and continuous improvement initiatives.
• Knowledge of healthcare, pharmaceutical, distribution, or highly regulated industries.

At McKesson, we care about the well-being of the patients and communities we serve, and that starts with caring for our people. That’s why we have a Total Rewards package that includes comprehensive benefits to supportphysical, mental, and financial well-being. Our Total Rewards offerings serve the different needs of our diverse employee population and ensure they are the healthiest versions of themselves.

As part of Total Rewards, we are proud to offer a competitive compensation package at McKesson. This is determined by several factors, including performance, experience and skills, equity, regular job market evaluations, and geographical markets. The pay range shown below is aligned with McKesson's pay philosophy, and pay will always be compliant with any applicable regulations.In addition to base pay, other compensation, such as an annual bonus or long-term incentive opportunities may be offered.

Our Base Pay Range for this position

McKesson has become aware of online recruiting-related scams in which individuals who are not affiliated with or authorized by McKesson are using McKesson’s (or affiliated entities, like CoverMyMeds or RxCrossroads) name in fraudulent emails, job postings or social media messages. In light of these scams, please bear the following in mind:

McKesson Talent Advisors will never solicit money or credit card information in connection with a McKesson job application.

McKesson Talent Advisors do not communicate with candidates via online chatrooms or using email accounts such as Gmail or Hotmail. Note that McKesson does rely on a virtual assistant (Gia) for certain recruiting-related communications with candidates.

McKesson job postings are posted on our career site: careers.mckesson.com.