Sap Security And Grc Lead

Role overview

We're looking for an experienced SAP Security and GRC lead for a large S/4HANA transformation that consolidates two SAP landscapes and includes upgrades to S/4HANA 2025.

You'll lead S/4HANA and Fiori role design, run SAP GRC Access Control through the program, and build the SAP side of a SailPoint integration so access requests and removals flow through one governed process.

This is a hands-on lead role. You'll design and build roles yourself, guide one or two security consultants as the workload grows, and work closely with functional teams, Basis and the security organisation.

Responsibilities

• Role design and build: design and build roles for S/4HANA, embedded Fiori, BW/4HANA, MDG, GTS and other S/4 components, following client standards.
• Landscape consolidation: analyse roles from the incoming SAP estate, map users to the target role design, and get business and design authority sign-off.
• Fiori security: rebuild front-end and back-end roles when moving from a Fiori hub to embedded Fiori, including spaces, pages and catalogues.
• GRC Access Control: run ARA, ARM, EAM (firefighter) and BRM, perform risk analysis on new and changed roles, assign mitigating controls, and maintain GRC connectors for new systems.
• SailPoint integration: set up the technical users, authorisations and role catalogue SailPoint needs on ABAP systems, decide with the client whether provisioning runs directly or through GRC, and test joiner, mover and leaver flows.
• Upgrades: run SU25 and role remediation for S/4HANA release upgrades, including HANA database users and roles where needed.
• Licensing: set up a process to review user licence classification (FUE) so role changes don't increase licence cost without anyone noticing.
• Environments: protect user and role data during system refreshes and build security for new environment tiers.
• Documentation and support: write requirement, configuration and design specifications, support SIT and UAT security testing, and resolve access incidents during hypercare.
• Assessment: contribute to a recommendation on SAP GRC on-premise versus SAP Cloud IAG.

Skills and experience

Required

• 5+ years in SAP security, including at least two full S/4HANA implementations or conversions.
• 5+ years with SAP GRC Access Control 12.0 (ARA, ARM, EAM, BRM), including connector setup and ruleset maintenance.
• Deep Fiori security knowledge: catalogues, spaces and pages, OData service authorisations, and hub-to-embedded migration.
• Hands-on SailPoint integration experience (IdentityIQ or Identity Security Cloud) with SAP ABAP systems, using the SAP Direct or SAP GRC connector.
• Upgrade security experience: SU24/SU25, authorisation default changes and post-upgrade role remediation.
• Experience consolidating two SAP security landscapes or leading a role redesign with business sign-off.
• Experience working in a regulated environment (GxP, SOX or similar) and writing validation-ready documentation.
• Experience leading or mentoring other security consultants.

Preferred

• Pharmaceutical or life sciences industry experience, including electronic signature controls.
• Security for SAP ATTP, MDG, GTS or BW/4HANA.
• SAP Cloud Identity Access Governance (IAG).
• SAP licensing and licence audits (FUE, USMM, LAW).
• HANA database security and audit policies.