EXPERIENCE SUMMARY:

• Over 9 years of SAP Security experience: 14(SAP Security) full life cycle projects, 2 upgrade projects, 1 GRC and 4 Support projects covering multiple SAP Systems /Landscapes
• Worked in large/medium - scale full lifecycle implementation projects: designing SAP Security concept and developing SAP security roles, testing, cut-over plan, go-live and post go-live activities
• Lead a team: design and develop SAP security solutions across multiple SAP Applications: ECC modules (FICO, HCM/HR, MM, PP, PS, QM, and SD), CRM (Sales & Marketing), Bank Analyzer, BI, eBanking, EP (ESS, MSS, Travel & Expenses, & SRM), SCM (DP & SNP), GRC, MDM, PI, Solution Manager, and SRM
• Involved in the Annual and Quarterly Security Validations, performing segregation of duties (SOD), critical action (CA), critical permission (CP) analysis, and remediation
• Carried out an analysis of Segregation of Duties (SOD) Matrix for the security developed in SAP and resolved SOD conflicts for SOX compliance using GRC ARA/RAR/CC, via mitigation controls
• Hands on experience using SAP Central User Administration (CUA) for user administration activities
• Worked on ticketing software like Clarify, Remedy, and Service Now for production support, as per SLA’s. Used HPQC to fix defects in testing phase
• Designed and developed role templates for Global Rollout Projects: One McCain(McCain Foods Limited), Blue Harmony(IBM), Molycorp(Illumiti)
• Worked with Global SAP implementing partners like IBM, Seal Consulting Inc and Illumiti on implementations ranging from 200 users to 400,000 users

TECHNICAL SKILLS

Skill Set: SAP Security ECC 6.0, 5.0, R/3 4.7, 4.6c; BA 7.1; BI / BW 7.0 & 3.5; BS 7.1; CRM 7.0; EP 7.0; MDM 5.5; PI / XI 7.0; Sol Man 7.1, SCM/APO 7.0 & 4.0; SRM 7.0

GRC Tools: SAP GRC VIRSA Suite10, 5.3, CC 4.0, FF 3.0, Courion Suite and SAP Fiori

Office Tools: MS-Office (MS-Word, MS-Access, MS-Excel, PowerPoint)

Key Skills: SAP security implementation, SAP security redesign, SAP GRC 5.3 tool suite, SAP Application security Maintenance & Support

SAP Training: GRC 300 & 310 by SAP(2010)

PROFESSIONAL EXPERIENCE

Confidential

Sr. SAP Security Analyst

Responsibilities:

• Lead role design & redesign workshops with Functional Consultants (FC’s), and Business Process Leads (BPL’s) to provide technical direction on SAP application security
• Involved in all the phasesoftheimplementation life-cycle including analysis, design, development of security solutions for business applications Bank Analyzer, and eBanking
• Responsible for reviewing security items to ensure testing is thorough and complete. Ensure that any gaps are mitigated and/or approved by business owner prior to implementing in production.
• Created Authorization Groups to restrict the table access and program access
• Review and correction of sensitive authorizations (S TABU DIS, S DEVELOP etc.)
• Provide production support / mini rollouts / enhancement projects on SAP applications like: Banking Services (BS), CRM, ECC, BI, PI, SolMan, and CUA as needed
• Involved in SOX remediation, clean ups and prepare SAP systems for Audit
• Implement standards for custom authorization objects.
• Worked with Solution Manager ChaRM Process
• SAP User License administration and reporting to SAP using USMM
• Support user administration non SAP applications like Open Text, Saleforce.com and Techcom

Confidential

SAP Security & GRC Consultant

Responsibilities:

• Principle consultant for SAP ECC, BI, CRM, EP, SolMan security
• Collaborate with functional team members and Business Process Owners (BPOs) to ensure that security settings met the requirements of the business and aligned with the defined controls and standards per Sarbanes-Oxley (SOX) IT regulations
• Gather requirements for SAP modules as position-based security roles by organizing and facilitating role mapping workshops with all functional & business teams
• Implemented GRC - AC 10.0 ARA (Access Risk Analysis) module
• Provided authorizations for Logistics users using SAP Fiori apps to approve PO's
• Defined and maintained procedures for user, role creation / enhancements
• Developed new processes and procedures within security, and did knowledge transfer
• Table Security, Table Authorization Groups, Critical Tables / Direct Updatable Tables
• Created training materials and trained security team and support teams involved
• Point of contact for Unit, Integration test cycles (ITC), UAT and Hyper-care
• Developed eCATT (Computer Aided Testing Tools) scripts and LSMW for user administration activities
• Manage annual license audits and classification for clients
• Documented and stored SAP security processes, procedures and standards on Share Point for organizational use

Confidential

Sr. SAP Security & GRC Consultant

Responsibilities:

• Lead security build team to provided technical direction to application security development, functional, integration and change release management functions
• Implemented GRC AC5.3: RAR, SPM and CUP modules
• Involved in all the phasesoftheimplementation life-cycle including analysis, designof business applications in ECC, BI, CRM, EP, PI, SCM, Solution Manager, and SRM environment
• Closely worked with Global Business Process Owners and Functional Team Leads in gathering information and provided recommendations to develop over all SAP Security Concept
• Have wide experience on GRC RAR tool for SOD Analysis such as User level, Role level, Authorization object level etc
• Designed, developed ESS, MSS, T&E, SRM roles, maintained authorization in back-end systems & mapped to Enterprise Portal roles
• Developed CRM Sales & Marketing PFCG roles from CRM Business Roles to maintain authorization
• Used System trace: ST01, SU53, SU56, RSSM Trace, RSECADMIN and analyzed tables (USR*, AGR*) to troubleshoot authorization issues.
• Created, managed and uploaded back-end roles to Enterprise Portal (EP)
• Involved in unit testing of roles, supporting users during SIT, UAT and Hyper-care
• Off-shore security lead, with a team size of 10, co-coordinating on-site off-shore activities
• Involved in gathering security requirements, design, development, testing, and implementation of new roles
• Ensured role-building follows business guidelines, and adhere to the controls requirement set forth by the internal audit/controls teams
• Involved in setting up table, program authorization groups and controlling the direct access to data in the tables
• Conducted knowledge transfer session of SAP security authorization concepts to new team members

Confidential

SAP Security Consultant

Responsibilities:

• Lead a team in security configuration and built roles as per Business Process Master List (BPML), Role to Position Mapping (RtPM), and SOX compliance
• SOD analysis, mitigation controls via GRC RAR
• Created and maintained GRC SPM user IDs in Critical Authorizations for both Project and End Users
• Worked extensively on security design for CRM Web UI - Channel Management, Customer Data Protection, and Org Structure Management
• Investigated and resolved authorization-related issues in a timely manner
• Point of contact for integration test cycles (ITC) and user acceptance test (UAT)
• Help internal audit teams with reports generated through SM19, SM20

Confidential,

SAP Security Consultant

Responsibilities:

• SAP System upgrade from R/3 4.6c to ECC 6.0
• Analyzed the existing model, planned the upgrade strategy, timeline, test plans, execution and warranty support
• Documented detailed current state process maps (AS-IS processes), recommendations, future state process maps (To-Be processes)
• Upgraded security objects using SU25
• Performed reconciliation of user master record and roles using PFUD and SUPC
• Did user locking, unlocking, and password resets using eCATT scripts and LSMW tool extensively.
• Supported all users at “Go Live” for immediate access updates or changes during mitigation and final role alignment by function
• Worked in conjunction withBusiness Analystand assist in requirementsgathering, design, development and testing
• Created roles, and users using MDM Console as per the business requirement
• Analyzed Segregation of Duties (SOD) with in MDM, and R/3 for provisioning and deprovisioning users using GRC tool Account Courier
• Defined and maintained procedures for FF user ID’s in backend R/3 system using Account Courier.
• Coordinated with global team in phases of implementation
• Helped internal audit teams with Change Tracking reports

SAP Security Consultant

Confidential

Responsibilities:

• Worked with Business Analyst and Techno Functional Team members to reduce the risk caused by applying 7SP’s (44-51)
• Impact analysis of OSS notes (700 security related) applied through SP’s
• Performed reconciliation of user master record and roles using PFUD and SUPC
• Remediation of Segregation of Duties (SOD) within SAP implementation, GRC VIRSA Systems Compliance Calibrator tool(4.0), Profile Generator (PFCG), Developed Roles and Profiles, User Administration
• Changes in roles/profiles were transported to production through Rev-Trac
• User administration using SU01, SU10, SUGR and CATT scripts
• Served as primary focal point for new SAP security requests
• Developed and maintained security administration policies, procedures and processes for SAP technical and user community
• Supported users via BW Structural authorization in BW system
• Designed security roles for APO by restricting on DP & SNP
• SOX clean up - redesigned the Roles
• Configured and Set up GRC Fire Fighters ID’s in Production systems
• Designed and constructed SAP Security Roles: Master and Derived Roles, and Composite Roles using the Profile Generator (PFCG)