SAP Security

The SAP Security & GRC Specialist oversees and executes the SAP security processes and roles design. He or she is responsible for the SAP GRC day-to-day operations, configuration, and updates. The role acts as a liaison between IT, the Internal & External Audit teams, and functional business stakeholders to ensure SAP systems meet regulations, policies, and compliance requirements. He or she develops SAP compliance programs to ensure regulatory requirements, such as Sarbanes-Oxley (SOX) and General Data Protection Regulation (GDPR), and others.

Essential Duties:

• Design, configure, and maintain SAP GRC solutions, including SAP GRC Access Control, SAP GRC Process Control, and SAP GRC Risk Management
• Design, develop, and implement security and compliance policies, procedures, and controls to protect the integrity, confidentiality, and availability of SAP systems
• Design and implement SAP role-based access controls (RBAC) to ensure that users have appropriate access to SAP systems and applications
• Design and adapt existing environment to reduce or eliminate segregation of duties (SODs) conflicts and place controls for mitigating risk where necessary
• Create and maintain process for SAP security role design and testing with proper adherence to change control
• Manage change process for access requests according to ITIL and ensure process aligns with role strategy and maintenance. Improve overall governance for new/change access request.
• Create and apply framework for SAP Fiori role design and launchpad
• Design, Develop and maintain SAP security policies, procedures, and controls in accordance with industry best practices and regulatory requirements
• Perform risk assessments and security audits of SAP systems and applications to identify vulnerabilities. Recommend and lead remediation strategies
• Provide guidance and support to SAP application owners/business stakeholders and users on security and compliance best practices to ensure that the SAP Security and GRC solution are meeting business needs
• Participate in SAP implementation projects to ensure that security and compliance requirements are integrated into the project plan
• Manage and lead exchange with Internal & External Audits to provide evidence of SAP system and application security and compliance
• Collaborate closely with the CoE Cyber Security and SAP Basis team to ensure that SAP systems and applications are integrated into the overall IT security framework

Qualifications:

• A bachelor’s degree is required for this position. A focus in information technology or computer science is strongly preferred; degrees in other disciplines will be considered in combination with experience as outlined in the next bullet point.
• At least five (5) years of relevant hands-on experience in SAP security, role definition and design
• At least five (5) years of experience with SAP security and GRC tools, such as SAP GRC (Access Control, Process Control, Risk Management), and SAP Audit Management
• At least five (5) years knowledge of regulatory requirements, such as SOX, GDPR, and HIPAA including responsibilities in SAP audit coordination
• Proficient in SAP S/4 and Fiori launchpad configurations, catalogue or group setup, and security frontend role setup
• Proficient with SAP BTP solution and authorization management
• Proficient knowledge of SAP BW InfoCubes and SAP BPC
• Proficient understanding of SAP functional modules, such as Financial Accounting and Controlling (FICO), Material Management (MM), and Sales and Distribution (SD)
• An SAP certification in security and/or SAP GRC is preferred
• An ITIL certification is required
• Experience working with a hybrid team consisting of internal technology experts and external partners is a strong plus
• Experience in working within a geographically distributed matrix organization of a global manufacturing enterprise is helpful
• Excellent oral and written English language proficiency is essential
• Strong customer service orientation and relationship building skills are crucial for success in this role.