SAP GRC Lead

GAF•Parsippany, NJ

1d•$140,000 - $192,500

About The Position

The SAP GRC Lead is a senior specialist responsible for governing identity, access, risk, and compliance across the organization's SAP landscape. The role owns the end-to-end GRC strategy spanning SAP GRC Access Control, SAP Identity Access Governance (IAG) on BTP, and the security models for SAP Ariba, SAP Analytics Cloud (SAC), and SAP Integrated Business Planning (IBP). It is accountable for SoD risk mitigation, access provisioning governance, and audit readiness across on-premise and cloud-based SAP systems. The role defines and maintains the enterprise GRC framework, administers SAP GRC Access Control modules and IAG on BTP, and governs security models and access certification for the specified SaaS platforms. It partners with business process owners, IT Security, Internal Audit, and vendors, and mentors GRC analysts and role administrators.

Requirements

Bachelor’s degree is required.
8+ years of SAP security and GRC experience, including at least 3 years in a lead or architect capacity.
Deep hands-on expertise with SAP GRC Access Control (AC 12.x), including ARM, ARA, EAM, and BRM modules.
Proven experience implementing and administering SAP IAG on BTP.
Demonstrated experience governing the security model for at least two of SAP Ariba, SAP Analytics Cloud, and SAP IBP.
Strong understanding of SoD concepts, audit principles, and access control frameworks, including SOX and ITGC.
Knowledge of SAP authorization concepts, including authorization objects, PFCG role design, structural profiles, and S/4HANA role design.
Experience with SCIM API integration for automated provisioning across SaaS platforms.
Working knowledge of SAP BTP XSUAA and role collections.
Strategic and visionary leadership skills, including strategic thinking, driving innovation, and decision-making.
Change management and adaptability skills, including managing resistance, adaptability, and resilience.
People and relationship management skills, including emotional quotient, communication, and collaboration.
Technical and business acumen, including digital literacy, business/finance acumen, and process design.
Personal drive and mindset, including growth mindset, action orientation, and courage.

Nice To Haves

SAP Certified Application Associate – SAP GRC Access Control or equivalent certification.
Experience with SAP Identity Authentication Service (IAS) and Identity Provisioning Service (IPS) for automated lifecycle management.
Experience integrating GRC workflows with ITSM platforms such as ServiceNow or Jira for automated access requests.
Knowledge of S/4HANA CDS view-level access control and ABAP-level authorization debugging using SU53, ST01, and SU24.
Flexibility to travel, potentially extensively, for program activities, vendor meetings, and site visits.

Responsibilities

Define and maintain the enterprise GRC framework across SAP on-premise and cloud systems, aligned with internal audit, legal, and regulatory requirements.
Own the SoD rule-set across connected SAP systems; manage conflict detection, mitigation controls, and compensating-control documentation.
Lead periodic access review and certification campaigns and drive remediation to closure.
Establish policies and procedures for privileged access, emergency access management (EAM/Firefighter), and periodic user access reviews.
Administer and configure SAP GRC Access Control modules: ARM, ARA, EAM, and BRM.
Design and maintain the GRC connector landscape for S/4HANA, ECC, and connected SaaS systems.
Manage GRC workflow configuration, MSMP routing rules, and approval hierarchies.
Review rulesets and refine risk definitions to reduce false positives while maintaining SOX and audit coverage.
Own SAP IAG deployment on BTP, including tenant configuration, IAS integration, access analysis, and role assignment workflows.
Manage BTP trust configuration between IAG and SaaS platform connectors.
Coordinate with the BTP Integration Lead on XSUAA scoping, role collection design, and subaccount trust settings relevant to IAG.
Govern SAP Ariba security, including procurement and sourcing role design, user provisioning, SoD rules, Ariba Network realm administration, and supplier access governance.
Govern SAP Analytics Cloud security, including team and role design, story, model, and data permissions, and integration with CDS view security for governed data access.
Govern SAP IBP security, including supply-chain planning roles, keyfigure-level access, planning area security, IBP-to-S/4HANA integration security, and cross-system SoD alignment.
Maintain consistent naming conventions, provisioning workflows, and access certification cycles across the three SaaS platforms.
Partner with Business Process Owners, IT Security, and Internal Audit to align GRC priorities and risk appetite.
Mentor GRC analysts and role administrators and build team capability in IAG, SaaS security models, and audit processes.
Engage with SAP and third-party vendors on product roadmap, patches, and best practices.
Travel as needed for program activities, vendor meetings, and site visits; travel may be extensive at times.