Sr ERP Risk & Control Advisor

As a Senior ERP Risk & Control Advisor, you will provide specialist cyber, technology, and information risk advisory services across Shell’s ERP landscape and strategic transformation programs. You will lead risk assessments, influence secure-by-design control implementation, and leverage risk, audit, vulnerability, and operational insights to identify and address material risks across ERP environments.

Working closely with the BISO organization, ERP leadership, architects, product teams, and CISO specialists, you will enable informed, evidence-based risk decisions while promoting effective governance, standardized controls, and sustainable remediation. Your work will strengthen the security, resilience, integrity, and compliance of Shell’s ERP ecosystem.

• Location: The Hague, Netherlands
• Time type: Full time
• Worker Type: Regular
• Experience Level: Experienced Professionals

The role sits within the Enterprise Risk Services (ERS) Governance, Risk & Compliance (GRC) team, providing strategic risk advisory support across ERP platforms, enterprise applications, cloud technologies, and digital transformation initiatives. Combining deep ERP expertise with cyber risk and governance capabilities, you will help business and technology leaders make risk-based decisions aligned with Shell’s security and control frameworks.

What you’ll be doing

• Serve as the primary Cyber and Information Risk Advisor across Shell’s ERP landscape and strategic transformation initiatives.
• Build trusted partnerships with business leaders, product owners, architects, engineers, and program teams to embed risk-based decision-making.
• Provide specialist advisory support across SAP S/4HANA, SAP ECC, SAP BTP, SAP Fiori, SAP GRC, Workday, enterprise integration platforms, and cloud-hosted ERP solutions.
• Lead Information Risk Assessments (IRAs), DPIAs, security architecture reviews, control assurance activities, and supplier security assessments.
• Identify, assess, and manage cyber, technology, and information risks, ensuring alignment with Shell’s risk appetite and regulatory obligations.
• Advise stakeholders on risk treatment, mitigation, acceptance decisions, and sustainable remediation strategies.
• Drive the implementation of security standards, policies, and control requirements across projects, products, and operational environments.
• Review ERP and enterprise application risk exposure using KRIs, audit findings, vulnerability data, compliance metrics, and control performance indicators.
• Assess and advise on key ERP risk domains, including Segregation of Duties (SoD), Identity & Access Management, Privileged Access Management, Change Management, Application Security, Data Protection, Third-Party Integrations, and Business Continuity & Disaster Recovery.
• Support major transformation programs involving cloud adoption, ERP modernization, digitalization, AI-enabled capabilities, and third-party integrations.
• Review architectures, integrations, APIs, middleware, and data flows to identify security and compliance risks and opportunities for control automation.
• Influence governance outcomes through active participation in architecture review boards, risk committees, and project steering forums.
• Present risk insights and recommendations to senior business and technology leaders, challenging stakeholders where required to improve control effectiveness and security outcomes.
• Partner with BISO, CISO, Enterprise Architecture, Business IDT, SOM, and operational teams to manage the ERP risk landscape and continuously enhance governance, controls, and compliance processes.
• Interpret and apply relevant regulatory and industry requirements, including GDPR, NIS2, data privacy obligations, and cybersecurity standards.
• Reports to the Risk & Control Manager – ERP within the Governance, Risk & Compliance function, with a dotted-line relationship to the BISO organization.
• Acts as a core member of the BISO Natural Team and key ERP risk leadership forums.

What you bring

• Strong expertise in SAP security, ERP controls, and technology risk management, with a solid understanding of governance, risk, and compliance (GRC) principles.
• Deep knowledge of ERP platforms and enterprise application security, with the ability to bridge cybersecurity, technology, and business objectives.
• Proven ability to provide pragmatic, risk-based advice that enables secure-by-design outcomes across complex ERP and digital transformation programs.
• Demonstrated success influencing, challenging, and partnering with senior business and technology leaders on risk, control, and security decisions.
• Strong stakeholder management, communication, and relationship-building skills, with the ability to operate effectively across technical and non-technical audiences.
• Ability to translate complex cyber, technology, and ERP risks into clear business impacts and actionable recommendations for leadership.
• Experience leading risk assessments, governance activities, and control assurance within large-scale ERP transformation, cloud migration, or enterprise modernization initiatives.
• Strong analytical and problem-solving skills, with the ability to prioritize risks and drive sustainable remediation in complex environments.
• Knowledge of regulatory, privacy, and cybersecurity frameworks, including GDPR, NIS2, ISO 27001, and other industry-recognized standards.
• Professional certifications such as CISSP, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Auditor, SAP Security, or SAP GRC certifications are preferred.

What we offer

You bring your skills and experience to Shell and in return you work with talented, committed people on one of the most important challenges facing our planet. You’ll have the opportunity to develop the skills you need to grow in an environment where we value honesty, integrity, and respect for one another. You’ll be able to balance your priorities as you become the best version of yourself.

• Progress as a person as we work on the energy transition together.
• Continuously grow the transferable skills you need to get ahead.
• Work at the forefront of technology, trends, and practices.
• Collaborate with experienced colleagues with unique expertise.
• Achieve your balance in a values-led culture that encourages you to be the best version of yourself.
• Benefit from flexible working hours, and the possibility of remote/mobile working.
• Perform at your best with a competitive starting salary and annual performance related salary increase – our pay and benefits packages are considered to be among the best in the world.
• Take advantage of paid parental leave, including for non-birthing parents.
• Grow as you progress through diverse career opportunities in national and international teams.
• Gain access to a wide range of training and development programmes.