SUMMARY

• Having 9+ years of experience in SAP Security and GRCAccess Control (Certified) Administration, Quality Assurance, and IT Risk Compliance management in Digital, Manufacturing, Lighting, Oil, Gas and Consumer goods domains
• Demonstrated analytical, management and consulting skills in the IT Industry
• As leading team, provided day - to-day guidance, feedback and on-the-job coaching to new team members, peers, and direct reports. Conducted interviews, training for organization growth
• Expertise in full lifecycle management of SAP Security/ GRC which includes analysis, requirement definition, planning, design, implementation, test and production rollout
• Given presentations for Project kickoff meetings, Designed Blueprint by conducting workshops in requirements gathering phase, and prepared GRC 12 & ABAP Roles design documentation for Sign Offs, test scripts for UAT and End User training documents for the repository
• Experience in project documentation & templates (Business Blueprint, Process definition, Role Definition, Business Requirement and SOD Matrix etc.)
• Co-ordinated with clients to estimate project cost and resource management
• Extensively worked in all project development phases including Analysis, Design, Development, Configuration and Customization of SAP Security, ABAP Roles & GRC Solutions for multiple SAP Lifecycles
• Hands-on experience in Full Life Cycle Implementations (GRC AC 10.0/10.1 and ECC), Upgrades (ECC, GRC 10.0 to GRC 10.1 and GRC 12 including NetWeaver upgrade,e), S4HANA-Fiori Analysis, Data Migrations, GRC archiving, GRC refresh, ECC Rollouts, Go-Live, Post Go-Live, and Operations Support projects
• Expertise in design and execution of GRC technical configuration with Access Control management integration
• Worked in SAP R3/ECC security, SAP BI security, HR security, SAP S4HANAand HANA security and GRC access control 5.3/10.0/10.1/12
• Provided support for CRM, Solution Manager, APO systems and good knowledge on SAP FIORI, Process control.
• Experience in SAP Portal Security, and SAP IDM and MYID
• Audit experience with KPMG
• Good experience in General authorizations, Structural authorizations, Analysis authorizations, Authorization Management, User & Role Administration, CUA administration, Transport management, SAP Security marketplace administration
• Compliance Management (SOD review, Risk analysis remediation, Mitigation and Managing activities) and User access reviews
• Worked with Service manager, JIRA and Charm tools

TECHNICAL SKILLS

ERP Applications: GRC Access Control (GRC 5.3/10.0/10.1/12 ), SAP R3 4.6c /ECC 6.x/7.0 Security, SAP HR Security, SAP BW 3.5/BI 7.x Security, SAP S4HANA 1809 Security, SAP HANA 2.0 Security, SAP marketplace Administration, SAP IDM and MYID.

Security Tools: SAP GRC/Virsa/Bizrights (4.0,5.3,10.0,10.1,12.0)(Compliance Calibrator, Access enforcer, Risk Terminator, Firefighter, Access Control), SAP IDM, MYID,CUA, SolutionManager, Charm, Aveksa, RTADS

PROFESSIONAL EXPERIENCE

Confidential

SAP Security GRC Lead

Responsibilities:

• Single point of contact for all SAP Security & GRC related policies and architecture.
• Worked with SAP Security & GRC Team to handle projects, ticket support, and enhancements to the client
• Ensured IT controls and procedures are compliant as per internal and external auditing requirements
• Conducted workshops with stakeholders, gathered requirements, designed blueprint for GRC Upgrade project (NW 7.02 ->NW 7.04->NW 7.52+ AC12 upgrade, Plugin systems), Implemented, Performed Post upgrade activities (Su25 upgrade, Role's update, functionality test, bugs and fixes. etc.), Prepared UAT test cases and cutover activities
• Performed GRC 10.0 refresh followed by project activities for GRC 12 upgrade, SAP/GRC data migration and GRC archiving to avoid consistency issues
• Validated SU25 security post installation activities using SAP standard practices prior to production rollout
• Compliant with change management guidelines while moving TR’s (Transport Requests) to the production
• Worked on SAP S4 HANA 1809- Fiori Project analysis and creation of fiori catalogues and fiori groups.
• Worked with business process subject matter experts to identify process improvements, suggested recommendations and implemented solutions in support of business objectives
• Designed & Created custom GRC rule set to avoid manual verification of business risks
• Integrated new SAP systems with GRC - ARM, EAM (CEAM, DEAM), ARA and BRM, proposed and automated few GRC areas to avoid manual effort
• Provided custom solutions such as Locking & unlocking of FFID’s in plugin systems depending on actions for FF log reviews, GRC custom reports and automatic generation of pending FF log review list, Email trigger to the end users with expiring roles info and Access requests such as Pending Role approvers list, expired approvers list.
• Designed, implemented and supported security for SAP GRC Access Controls, ECC, S4HANA 1909, BI, Solution Manager, Business Objects & Native HANA database applications.
• Suggested SOP improvements to clients and followed up for approvals. Organized internal technical discussions, knowledge sharing sessions on the production issues to groom team members
• Established a well-defined rotational structure within the team for handling support across various time zones, provided guidance specially to handle tickets on HANA, GRC and created activity checklists to ensure quality
• Conducted interviews, given training sessions on SAP Security and GRC skills in the organization

Confidential, NY

Senior SAP Security GRC consultant

Responsibilities:

• Responsible for quarterly recertification reviews. As POC (Point of Contact), conducted meetings, monitored reviews, reassigned authority and provided required guidance to the approvers
• Investigated Issues in ECC 6.0, BI7.x, GRC 10.1 systems and GRC-IDM integration issues, GRC web services issues
• Created IDM Access requests for Fire Fighter Access, to create, modify and delete users in SAP systems
• Reviewed SAP production access requests with SOD conflicts, Analyzed SODs’ and resolved via access removal with requestor confirmation or apply mitigation controls with SOD controllers’ approval
• Performed semi-annual mitigation review and documented all the approvals for audit purpose
• Created and updated FFID owners and controllers, mitigation controller Ids in SAP GRC
• Performed rule set updates for SAP systems in the SAP GRC
• Worked with various business contacts to identify role approvers to get the changes updated in BOR (Book Of records)/GRC. Publish BOR on a weekly basis
• Responsible for security implementation, design, build, develop roles according to the functional requirements
• Created and copied analysis authorizations, transported across the landscape and assigned to the users
• Created BI roles and provided required permissions to users
• Good knowledge on data modelling (RSA1& RSMM activities)
• Worked on creating repository roles & HANA User maintenance
• Minimized audit findings to near 0 by assessing current risk position around segregation of duty violations / critical actions and providing remediation or facilitating mitigating actions in the form of monitoring
• Groomed juniors, given training in organization level, worked with seniors for solutions and to design ROP (Request for Proposal) for GRC 12.

Confidential, Cleveland, OH

Senior GRC Consultant

Responsibilities:

• As part of the COE (center of excellence) team, Performed GRC 10.1 end-to-end Access Control implementation in the training system to use the environment for training purposes and to build/ test solutions for client requirements
• Gathered all the business requirements from customers, prepared a requirements matrix, and worked in GRC 10.0 implementation
• Configured SAP GRC Access Control with all the four modules such as Access Risk Analysis (ARA- Risk Analysis, Mitigation), Access Request Management (ARM- Workflows, Auto provisioning), Emergency Access Management (EAM- Centralized) and Business Role Management (BRM- Role approval, Role provisioning, Business role concept)
• Activated services (Public, BC and GRC), BC (Business Configuration) sets and Created GRAC roles based on functionality and created connectors for all the systems within the landscape and integrated all SAP systems
• Scheduled all synchronization jobs and executed Batch Risk Analysis jobs periodically
• Created SOD matrix as per the audit team requirements, designed custom ruleset based on the global ruleset provided by SAP, created mitigation control IDs and assigned to Access Risk IDs
• Created access request types and maintained actions as per client requirement
• Maintained and configured MSMP workflows for access request approval, role approval, Firefighter log review approval and user access review approval processes
• Created custom initiator and agent rules as per client requirement by using BRF+ application for Access request workflow and detour path at role owner stage
• Designed role methodology process and steps as per client requirements. Created business roles as needed
• Configured centralized Firefighter ID mechanism and creation of Firefighter IDs, Firefighters, Firefighter owners and controllers, assigned Firefighter IDs to Firefighters via admin rights
• Created custom notification template IDs and maintained the subject line to notification emails
• Performed unit & integration testing in development, maintained quality and documented results
• Worked on configuration changes and new enhancement-based functionality requirements in GRC
• Regenerated SOD roles post addition /removal of connector
• Created templates for template administration
• Integrated SAP HANA 2.0 to GRC 10.1
• Done user management in HANA studio and HANA cockpit including standard users, restricted users and technical database users and created roles.

Confidential, Houston, Tx.

Senior GRC Consultant

Responsibilities:

• Reviewed compliance activities such as user access review, segregation of duties for SAP and JDE systems
• Done health connection between SAP and GRC systems
• Used RTADS to-do continuous monitoring of connectivity between JDE system and GRC 5.3
• Used RTADS for retrieving the data from JDE backend systems such as metadata update, role usage, user sync, user action Permissions
• Executed purge action, full user sync, full batch risk analysis in RAR and role usage sync in ERM
• Generated UAR and SOD requests
• Analyzed dispatch UAR and SOD reports in CUP and setup DOA for new reviewers
• Executed email dispatcher, email reminder jobs for UAR and SOD requests when needed
• Rerouted manage rejection to the correct supervisor
• Analyzed SOD conflicts at security stage and updated corresponding roles & approved UAR and SOD requests
• Removed roles manually for JDE systems if SOD conflicts found
• Escalated with case supervisors, who haven’t taken appropriate actions on requests
• Prepared Audit reports for providing the proofs for the activities performed during the round
• Analyzed issues related JDE systems, RTADS and interacted with respective teams to resolve the issues

Confidential

Senior SAP Consultant

Responsibilities:

• Worked as user, role, authorization admin and provided production support
• Analyzed missing authorizations and provided required permissions
• Proficient in using SUIM (Information system)
• Worked with profile generator (PFCG) to create, maintain and delete roles
• Expertise on SU24 updates, mass SU24 updates using upload/download options and role modifications
• Worked closely with functional teams for gathering business and control requirements, and with technical teams to ensure the development of appropriate custom transaction codes and role modifications
• Created authorization groups to control the access of the tables and assigned to the users via roles
• Created and released transport requests (customizing, workbench requests)
• Performed SOD analysis using compliance calibrator (virsa Tool) and remediated risks
• Created and assigned users to different role groups in the portal system (Enterprise Portal)
• Executed, implemented, and provided support for security procedures
• Worked with internal / external audit, segregation of duties analysis and SOX Compliance

Confidential, Houston, TX

SAP Consultant

Responsibilities:

• Technical support for security design and general project management support
• Hands-on experience on general authorizations and structural authorizations
• Handled HR control access requests for Time, ESS and MSS
• Assigned roles to users based on the position /org unit and created PD profiles as per requirement
• Performed user analysis to uncover SOD violations for users, monitored daily extractions for Dev and Prod using Biz rights (Approva Tool).
• Created and assigned users to different role groups in the portal system (Enterprise Portal)

Confidential

SAP Security GRC Consultant

Responsibilities:

• Cross-trained in SAP security and GRC, swiftly demonstrated the ability to analyze, configure and maintain security roles and authorizations for SAP ECC 6.0, HR and BW3.5 systems
• Successfully collaborated with a 15-member 24x7 security support team while contributing in areas of process improvements, communication within the team and developing technical expertise
• Performed user administration, role administration, CUA administration, troubleshooting, OSS connection, DDIC and client opening activities, Go live support, GRC 5.3/10.1 support
• Designing template solutions and roll-outs for ECC landscape, conducted fit gap analysis, design workshops with functional teams, realization, cutovers, hyper-care and transition to support
• Involved in security blueprint and building the SOD matrix, defined technical roles, and its implementation
• Worked on role builds, SU25 activities for multiple projects