SAP GRC and Security Lead

Key Responsibilities

• Lead the design, configuration, implementation, and support of SAP GRC Access Control across SAP S/4HANA and ECC systems.
• Design, implement, and maintain multiple SAP GRC rulesets to support business, regulatory, and organizational requirements.
• Develop and maintain SAP GRC and SAP Security strategies aligned with enterprise risk, compliance, and security objectives.
• Map business processesincluding Batch Release, Quality Management, Production Planning, and Materials Management—to relevant security risks and controls.
• Identify, assess, and remediate high-risk SoD conflicts and critical access risks, particularly within regulated GxP processes.
• Incorporate custom transactions into standard rulesets and develop appropriate risk assessments and mitigating controls.
• Define and apply risk-severity classifications, including High, Medium, and Low, within regulated SAP environments.
• Administer SAP GRC Access Control across multiple ECC and S/4HANA systems, considering the differing requirements of validated and non-validated environments.
• Design and coordinate rulesets and risk-analysis processes across landscapes containing both validated and non-validated SAP systems.
• Investigate and reduce false positives in risk analyses by improving ruleset design, risk definitions, and business-process mapping.
• Diagnose and resolve SAP GRC 12 workflow issues and optimize access-request and approval processes.
• Apply BRF+ expertise to configure, enhance, and automate Access Request Management (ARM) workflows.
• Provide hands-on configuration and administration of SAP GRC components, including Access Risk Analysis, Access Request Management, Business Role Management, and Emergency Access Management, as applicable.
• Provide day-to-day SAP Security and GRC administration, including processing ServiceNow requests for user access, role changes, user removal, and other security-related activities.
• Support J-SOX, FDA, GxP, and other audit activities by maintaining appropriate evidence, documentation, risk assessments, and remediation plans.
• Partner with business owners and control owners to establish, document, monitor, and maintain mitigating controls.
• Provide guidance, mentoring, technical leadership, and knowledge transfer to SAP Security and GRC team members.
• Develop and maintain technical documentation, operating procedures, configuration documents, and support runbooks.

Required Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Business Administration, or a related field, or equivalent professional experience.
• Significant hands-on experience in SAP GRC Access Control.
• Experience implement at least two end-to-end SAP GRC Access Control implementations.
• Strong experience with SAP GRC Access Control 12 configuration, administration, troubleshooting, and workflow support.
• Demonstrated expertise in designing, implementing, and customizing multiple SAP GRC rulesets.
• Working knowledge of J-SOX, FDA, GxP, and related IT general control and computerized-system compliance requirements.
• Experience analyzing business processes and mapping them to access risks and security controls.
• Experience with custom transaction analysis and integration into SAP GRC rulesets.
• Strong analytical and problem-solving skills, including the ability to identify and reduce false positives.
• Excellent written and verbal communication skills.
• Ability to collaborate effectively with technical teams, business stakeholders, auditors, Quality and Validation teams, and control owners.

Preferred Qualifications

• Experience with BRF+ configuration for SAP GRC Access Request Management workflows.
• Experience with SAP GRC integration across multiple ECC and S/4HANA systems.
• Experience supporting regulated environments subject to FDA, GxP, or similar requirements.
• Experience with audit remediation, control design, control hierarchies, and compliance reporting.
• SAP GRC certification.
• Experience developing training materials, process documentation, and operational runbooks.