SAP Security GRC

SAP GRC Access Control

• Implement, configure, and support SAP GRC Access Control modules, including:
  • Access Risk Analysis (ARA)
  • Access Request Management (ARM)
  • Emergency Access Management (EAM)
  • Business Role Management (BRM)
• Configure and maintain risk rulesets, mitigating controls, and compliance policies.
• Perform Segregation of Duties (SoD) analysis and remediation activities.
• Manage access provisioning workflows and approval processes.
• Support periodic user access reviews and certification campaigns.
• Develop compliance reports, dashboards, and audit-related documentation.
• Ensure effective governance of user access lifecycle management.

SAP Security & Authorization

• Design, build, and maintain SAP security roles and authorizations across SAP applications.
• Implement Role-Based Access Control (RBAC) aligned with business and compliance requirements.
• Design and maintain:
  • Single Roles
  • Composite Roles
  • Derived Roles
  • Firefighter Roles
  • Business Roles
• Support user access provisioning, role assignment, and security administration activities.
• Conduct security reviews, role optimization, and authorization assessments.

Risk & Compliance Management

• Identify, assess, and mitigate access and compliance risks across SAP systems.
• Configure mitigating controls and monitor compliance effectiveness.
• Support SOX, ITGC, internal audits, and external compliance assessments.
• Perform risk analysis for new role designs, user provisioning requests, and system changes.
• Collaborate with business process owners to reduce access conflicts and compliance violations.

SAP Fiori & S/4HANA Security

• Support SAP Fiori security integration with GRC Access Control.
• Manage Fiori catalogs, groups, spaces, pages, and authorization concepts.
• Analyze and resolve authorization issues related to SAP S/4HANA and Fiori applications.
• Support S/4HANA role redesign and security transformation initiatives.

Audit & Governance

• Coordinate with audit teams during compliance reviews and security assessments.
• Prepare evidence, reports, and risk mitigation documentation.
• Ensure adherence to corporate security policies and regulatory standards.
• Drive continuous improvements in access governance and compliance processes.

Mandatory Skills

• 6-12 years of SAP Security and GRC experience.
• Strong hands-on experience in SAP GRC Access Control.
• Expertise in:
  • Access Risk Analysis (ARA)
  • Access Request Management (ARM)
  • Emergency Access Management (EAM)
  • Business Role Management (BRM)
• Strong knowledge of Segregation of Duties (SoD) concepts and risk remediation.
• Experience in SAP Security & Authorization administration.
• Hands-on experience with:
  • Role Design
  • User Administration
  • Firefighter ID Management
  • Access Reviews
  • Compliance Reporting
• Experience in SAP S/4HANA Security and Fiori Security.
• Strong understanding of SAP authorization concepts and RBAC methodologies.
• Knowledge of audit, compliance, and risk management practices.

Preferred Skills

• SAP GRC Process Control experience.
• SAP BTP Security experience.
• SAP Identity Authentication Service (IAS) and Identity Provisioning Service (IPS).
• SAP Cloud Identity Access Governance (IAG).
• BW/4HANA Security experience.
• Knowledge of SOX, ITGC, GDPR, and regulatory compliance frameworks.
• SAP Security and SAP GRC certifications preferred.

Soft Skills

• Strong communication and stakeholder management skills.
• Ability to interact with business users, auditors, and leadership teams.
• Excellent analytical and problem-solving capabilities.
• Strong documentation and governance mindset.
• Ability to lead workshops, compliance discussions, and risk review meetings.