Sr Mgr, SAP & Enterprise Applications Security Specialist

Newell Brands•Atlanta, GA

3d•Hybrid

About The Position

The SAP & Enterprise Applications Security Specialist owns the design, engineering and governance of access across Newell’s SAP landscape — ECC, S/4HANA, SAP GRC Access Control, SuccessFactors, Ariba, IBP, VisualFabriq and the broader SAP cloud environment. SAP is the anchor of the role, with scope extending to any in-scope enterprise application. This position sits within the Identity and Access Management organization and works closely with SAP functional and Basis teams, application owners, business process owners, and internal and external audit. It partners closely with the Identity Governance and Access Operations teams, supplying the role designs and entitlement definitions that onboarding and provisioning processes depend on. The ideal candidate thinks in terms of how access should work, stays current on where SAP security and identity are heading, and knows where to spend review effort and where to automate.

Requirements

7+ years of hands-on SAP security and authorizations experience across ECC and S/4HANA, including role engineering with single, composite and derived roles.
Strong understanding of access risk management and hands-on SAP GRC Access Control experience (ARA, ARM, BRM and EAM), including access risk analysis and mitigating controls.
Working knowledge of RBAC, with practical exposure to ABAC and PBAC concepts.
Experience with access reviews and certifications using both role-based and risk-based approaches.
Working understanding of how SAP and application roles integrate with an IGA platform such as SailPoint Identity Security Cloud (ISC) or IdentityIQ, including SAP to IGA integration controls.
Experience supporting SOX IT general controls and working directly with internal and external auditors.
Ability to work across functional, Basis, audit and IAM teams without direct authority, and to explain access risk to both technical and business audiences.
Bachelor’s degree in information technology, computer science, information security or a related field, or equivalent professional experience.

Nice To Haves

SailPoint certification (ISC or IdentityIQ) or SAP security or GRC certification.
S/4HANA role redesign or migration experience (greenfield or brownfield).
Experience with SAP Fiori, OData, HANA database security and SAP BTP security.
Experience with SuccessFactors Employee Central security and SAP Cloud Identity Services (IAS/IPS).
Familiarity with SAP Identity Access Governance (IAG) or other cloud GRC tooling.
CISSP, CISM or equivalent security certification.

Responsibilities

Design, build and maintain SAP authorization roles (single, composite and derived) and application-level roles, following consistent naming, transport and change management standards.
Lead role redesign efforts, including authorization concept work for S/4HANA and Fiori.
Apply the appropriate access model for each system — RBAC as the foundation, ABAC or PBAC where they fit.
Enforce least privilege across SAP and application roles (including Ariba, IBP and VisualFabriq), right-sizing roles and removing excessive or dormant access over time.
Support periodic user access reviews and certifications, applying both role-based and risk-based approaches.
Operate SAP GRC Access Control (ARA, ARM, BRM and EAM), including emergency and firefighter access administration.
Run access risk analysis at the user and role level and drive remediation of conflicts and critical access, in support of the Governance team’s SOD ruleset.
Support SOX IT general controls, audits and the annual review of SAP and SailPoint integration controls.
Supply role designs and entitlement definitions to the Identity Governance and Access Operations teams for use in onboarding and provisioning.
Serve as security liaison on SAP and S/4HANA projects, building roles to requirements and meeting delivery milestones.
Support security across the broader enterprise application portfolio, including Ariba, IBP, VisualFabriq, SuccessFactors, SAP Cloud Identity Services (IAS/IPS), HANA, BTP and Fiori.
Troubleshoot SAP authorization errors (SU53) and develop solutions in accordance with company standards.