SAP Security / GRC Consultant

Position: SAP Security / GRC Consultant

Location: Remote

Automotive or Manufacturing background is required

Position Overview

Seeking an experienced SAP Security / GRC Consultant to design, implement, and support SAP security and governance solutions across SAP ECC and SAP S/4HANA environments. The role focuses on user and role administration, access controls, SAP GRC, Segregation of Duties (SoD), compliance, risk management, and secure SAP transformation initiatives.

Key Responsibilities

• Design, configure, and maintain SAP security roles, profiles, authorizations, and access controls across SAP ECC and SAP S/4HANA environments.
• Implement and administer SAP GRC Access Control solutions, including Access Risk Analysis (ARA), Access Request Management (ARM), Business Role Management (BRM), and Emergency Access Management (EAM/Firefighter).
• Perform Segregation of Duties (SoD) and critical access risk analysis and remediation.
• Develop and maintain business roles, composite roles, single roles, and authorization objects based on business requirements.
• Manage SAP user provisioning, de-provisioning, password policies, user access reviews, and periodic access certifications.
• Configure and maintain SAP GRC workflows for access requests, approvals, risk analysis, and emergency access.
• Conduct security assessments and identify authorization gaps, excessive privileges, and compliance risks.
• Support SAP S/4HANA implementations, upgrades, migrations, and transformation projects from a security and GRC perspective.
• Integrate SAP GRC with SAP ECC, SAP S/4HANA, SAP Fiori, and other enterprise applications.
• Configure and support SAP Fiori catalogs, groups, spaces, pages, and related authorization concepts.
• Work with functional and technical teams to translate business requirements into appropriate SAP security roles and authorization models.
• Support SAP Cloud and hybrid security environments, including SAP BTP and related identity and access management requirements.
• Develop security design documents, role matrices, authorization concepts, risk reports, and technical documentation.
• Support internal and external audits by providing access evidence, SoD analysis, control documentation, and remediation support.
• Monitor security incidents, access violations, and authorization issues and coordinate resolution with technical teams.
• Establish and enforce SAP security standards, policies, procedures, and governance processes.
• Participate in security testing, UAT, cutover, hypercare, and post-production support activities.
• Provide recommendations for improving SAP security, access governance, compliance, and operational controls.

Required Qualifications

• 8+ years of experience in SAP Security and SAP GRC.
• Strong hands-on experience with SAP ECC and SAP S/4HANA security.
• Hands-on experience with SAP GRC Access Control.
• Strong knowledge of SAP authorization concepts, roles, profiles, authorization objects, and organizational levels.
• Experience with GRC modules including ARA, ARM, BRM, and EAM/Firefighter.
• Strong experience with SoD analysis, risk remediation, and critical access management.
• Experience supporting SAP S/4HANA implementations, upgrades, and migrations.
• Knowledge of SAP Fiori security and authorization concepts.
• Experience with SAP user administration, role design, provisioning, and access certification.
• Strong understanding of identity and access management principles.
• Experience supporting SOX, GDPR, NIST, and other security/compliance requirements.
• Strong analytical, communication, documentation, and problem-solving skills.

Preferred Qualifications

• SAP GRC certification or relevant SAP Security certification.
• Experience with SAP BTP security and Identity Authentication/Identity Provisioning.
• Experience with SAP Cloud Identity Services.
• Knowledge of SAP Cloud ALM and SAP Solution Manager.
• Experience with automated user provisioning and IAM integrations.
• Experience supporting large-scale SAP transformation and global implementation programs.
• Strong understanding of audit controls, compliance frameworks, and enterprise security governance.