SUMMARY

• Nearly 9 years of experience, SAP, GRC Implementation and Support projects, including Analysis, Design, Configuration, Customization, Reporting, Security Solution Development and Audit for various industries such as Oil and Gas, chemicals and Manufacturing & Retail.
• Very Good Experience on multiple modules of SAP Security in ECC, GRC 10.1,10.0,5.3, BI/BW, BOBJ, SRM, Portal, CRM, BPC, PI,CUA.
• Worked on various tools like LANDesk, SM7, SM9, HP ALM, CHARM and other user access request form portals.
• Experienced working on various projects involving SAP Security and GRC Implementations, Upgrades, Security Redesign/Remediation and Support projects
• Lead and executed the SAP upgrade and rollout projects & hands - on experience.
• Have worked for top Fortune 500 client company globally, which has provided me an opportunity to learn and perform with thehigh level of professionalism and work ethics.
• Providing technical consulting expertise and leadership to internal project teams and clients
• Experience in implementing 3 GRC 10.0, 10.1 projects which includes post installation steps and entire configuration of ARA, EAM and ARM.
• Experience in mitigation controls, SOD Analysis, Management reports, internal audits and compliance audits.
• Establishing and maintaining SOD and Critical Access rules and risk rankings within SAP GRC and maintaining rule set in GRC system and relating it to business controls.
• Designing SOD/SA controls as per the organization control framework and execute.
• Experience in the maintenance of the system SOD ruleset for GRC, and the SODA (non-SAP) ruleset, based on Financial Controls requirements
• Created the SOD (A) ruleset, SOD matrix for non-SAP systems using MS-Access.
• Performing testing for all modules on functionality simulates risk, generate rule ID and compare, test User access workflow, EAM workflow logs and User access reviews workflows.
• Have extensively worked on configuring MSMP & BRF Plus rules in GRC Access Control 10.0.
• Have experience in customization of MSMP Rules (Initiator/Agent/Routing) using BRF+ functionality as to fulfill the Business requirements.
• Performed automated UAR Reviews using GRC system.
• Creating process documentation like work instructions, flow charts, risk waivers, Compensating control documents and providing training to end users.
• Good experience in User Administration (creating, changing, maintaining user accounts and assigning roles) and Role Administration (Created and modified Single roles, Composite roles and Derived roles using automatic profile generator).
• Expert in User Tracing and Troubleshooting User Authorization issues.
• Experience in BI/BW, Built Analysis Authorizations using the transaction RSECADMIN, created roles restricting access to info cubes, specific queries and workbooks, Troubleshoot authorizations related problems using RSECADMIN.
• Performing/Coordinating Unit testing and organize transports in the system.
• Experience in PI Security related activities like creating UME Roles and assigning group.
• Experience in BO Security maintenance of user and group authorization in BOBJ
• Experience in BPC security activities creating TEAM, assign DAP, TAP, Model and Dimensions.
• Having experience working with internal and external audit teams.
• Worked on HP ALM for change management, requests, change approvals, Security ALM Creation, Maintaining ALM Status.
• Good hands on experience on internal audit and controls.
• Experience in preparing power point presentations, excel based reporting and Analysis.
• Experience in preparing flow charts and Work instructions.

PROFESSIONAL EXPERIENCE

Confidential

SAP GRC/Security Consultant

Responsibilities:

• Updating GRC ruleset and SOD Matrix after discussing with internal audit and Business.
• Establishing Controls in accordance with internal control framework and create SOP (Standard Operation Procedures) Ex: SOD/SA controls, mitigation ID reviews and UAR reviews.
• Establishing relation with Business controls and Mitigation controls in GRC.
• Analysis on new risks and act appropriate on CCDS or remediation.
• Configuring and Implementing EAM Process, performing post installation steps and configuration for decentralized firefighter.
• Creating FFIDs, Reason codes, Maintaining owners and controls.
• Scheduling back ground jobs and checking all jobs running correctly or not.
• Activating MSMP workflows and maintain customization as per business requirements.
• Performing testing on the configuration performed.
• Educating the current team in EAM process and creating work instructions and Flow charts.
• Providing trainings to business users on how to use EAM.
• Worked on CUA (Central User Administrator) to provide access for IT people
• Worked on tasks in CUA like Creating Users, Reset password, lock and unlock users, defining valid to date for users and test users.
• Leading role remediation project to ensure roles are risk free.
• Discussing with business and compliance in terms of role changes in SAP AFS and Retail systems.
• Maintaining SU24 changes, creation and maintenance of Role Matrix.
• Transported the generated roles and profiles using SAP transport management system.
• User Administration Monitoring, User Tracing and Troubleshooting User Authorization issues using SU53 and ST01.
• Creating weekly and monthly reporting in terms of SOD risk.
• Establishing new SOD and SA controls, Mitigation control review, custom T code review and SOD matrix review by preparing SOPs and training existing team members.

Confidential

SAP GRC Consultant

Responsibilities:

• Working with project team to remediate/mitigate the existing risks in GRC system.
• Redefining risks for finance process suggest/perform ruleset changes and transport across the systems.
• Creating mitigation controls for new risks.
• Training team to assign approvers in GRC system and creating documentation.
• Performing role imports.
• Executing IT controls (SOD SA), provide training to the existing users and creating process documentation.
• Maintaining FF ID owners, provision of FF access, Assigned owners/controllers to firefighter ids.
• Produced SOD Analytical Reports (both Summary and Detail) against Users using ARA.
• Performing UAR reviews using SAP GRC10.0.
• Create SOD/SA review to maintain risk free environment.
• Changes MSMP workflow as per new business requirement, perform/ organize testing and move to production.
• Document entire GRC activities and train existing team members.
• Performed controls for SAP ALL/SAP NEW, duplicate ID terminations, Duplicate ID clean up, SAP Licensing and other cleanup activities.
• Perform Roles changes as part of risk remediation process, organize testing and move across landscape.
• Maintain SU24 changes for custom transaction codes.
• Troubleshooting authorization issues using SU53 and trace with ST01 & STAUTHTRACE.
• Conducted unit, user acceptance and system integration tests. Document defects in HPQC, resolve the defects, document the test results, gather test signoffs, prepare cutover and go-live strategy, create user guidance documents for user interface with SAP and GRC systems, create work SOPs and work instructions for support teams, provide post go-live support
• Maintained/updated custom USOBT and USOBX table as per business requirements by activating and deactivating authorization checks.
• Transported the generated roles and profiles using SAP transport management system.
• Worked on BI Analysis Authorizations using RSECADMIN.

Confidential

Senior Analyst

Responsibilities:

• Post-installation of Configuration of GRC AC 10.0 Components.
• Configuration of Connectors, Connector Groups and Integration Scenario Frameworks.
• Activating BC Sets and Applications in Client.
• Building Rule sets, Functions and Risk IDs.
• Defined Role owners & approvers, User access approvers, Defined Risk Owners, Defined Mitigation monitors and approvers
• Configuring security reports to perform User & Role analysis to identify existing SoD Violations Risk.
• Using ARA produced Analytical Reports on User, User Groups, Roles and Profiles. Analysis reports provide real-time data and Management reports retain an offline history of SoD status.
• Daily monitoring of jobs that are necessary for the GRC application(s) to run effectively and efficiently.
• Configuration and designing of Emergency Access Management based on User ID.
• Maintaining FF ID owners, provision of FF access, Assigned owners/controllers to firefighter ids.
• Scheduling of Synchronization jobs for ARA and EAM.
• Produced SOD Analytical Reports (both Summary and Detail) against Users using ARA.
• Mitigation and remediation of users and roles for SOX using User/Role Analysis in ARA.
• Configuration of template designing with variable contents.
• Configuration of Workflow using MSMP.
• Conducted training classes for Auditors to understand GRC10 architecture and functionality.
• Work with the compliance, internal and external audit groups to facilitate strong controls around user access and usage of the system as appropriate.
• Point of contact for security activities
• Handling KT Sessions and client/Business calls
• User administration, Role administration, troubleshooting authorization issues of ECC, BI, and BPC.
• Analyzing SAP BI platform and creating BI Analysis authorizations.
• Reviewing ALM Tickets, gather change requests information, maintain the status in ALM, Creating ALM plan, Transport in ALM and perform testing.
• Addition, Removal of Transaction Codes, authorizations, authorization objects by modifying existing roles based upon change request.
• Performed Transportation of newly created roles/ modified roles.
• Performed User comparison in PFCG.
• Critical authorization objects such as S TABU DIS, S PROGRAM, S DEVELOP were restricted and monitored.
• Extensively worked on trouble shooting the user authorization issues, using report (SU53) and system tracing using ST01, STAUTHTRACE.
• Created Master, Derived Roles and Composite roles
• Performed profile setup, Team setup, User setup in BPC
• Setting up new repository and adding connectors
• Running repository synch jobs as needed.
• Provisioning roles to the users in CRM system
• Worked on BI Analysis Authorizations.
• Written Custom Rule sets and restricted BI reports access based on position, org unit.
• Monitored reports access to users whenever re-org happens.
• Transporting Security changes from development systems to quality and production servers
• Execute controls and perform internal auditing.

Confidential

Senior Analyst

Responsibilities:

• Worked as a project member in up gradation of 5.3 to 10.0
• GRC implementation; automation; upgrade experience with GRC RAR- ARA, CUP- ARM, SPM-
• Post-installation of Configuration of GRC AC 10.0 Components.
• Configuration of Connectors, Connector Groups and Integration Scenario Frameworks.
• Activating BC Sets and Applications in Client
• Configuration of template designing with variable contents.
• Configuration of Workflow using MSMP.
• Configuration and designing of Emergency Access Management based on User ID.
• Scheduling of Synchronization jobs for ARA and EAM.
• Created test user Id's and performed security testing, followed by user acceptance testing.
• Providing support on all security related issues and controls
• Configuring security reports to perform User & Role analysis to identify existing SoD violations Risk
• Using RAR & ARA produced Analytical Reports on User, User Groups, Roles and Profiles. Analysis reports provide real-time data and Management reports retain an offline history of SoD status.
• Conducted training classes for Auditors to understand GRC10 architecture and functionality
• Work with the compliance, internal and external audit groups to facilitate strong controls around user access and usage of the system as appropriate.
• Deploy and Configure GRC Access Control 10.0 suite to automate all user and role management processes via GRC components.
• Worked on GRC activities like handling User creation/modification/termination requests
• Handling escape route requests and performing security stage approval.
• Update GRC system to latest support pack and perform post installation configuration for Access control and other sub components, activate required BC sets and workflows, maintain the parameters in GRC and remote systems.
• Interaction with business readiness team, creation of role Architecture.
• Create roles depending on Architecture.
• Organize User acceptance testing and provide training to users.
• Cutover support and post cutover support.
• Responsible for day to day technical support and resolution of security issues, troubleshooting R/3 security problems.
• Analyzing of missing authorizations and assigning roles to users.
• Extensively worked on trouble shooting the user authorization issues, using report (SU53) and system tracing using ST01.
• Worked on Portal (ESS/MSS) related Security issues.
• Worked on BI Analysis Authorizations.
• Written Custom Rule sets and restricted BI reports access based on position, org unit.
• Monitored reports access to users whenever re-org happens.
• Authorization Objects such as S RS AUTH, S RS COMP, S RS COMP1 were restricted and monitored.
• Transporting Security changes from development systems to quality and production servers

Confidential

SAP Analyst

Responsibilities:

• User administration, Role administration, troubleshooting authorization issues of ECC, HR.
• Tracking user’s day to day issues using ticketing tool.
• Ensure role-mapping Big Rules are followed and no SOD conflict roles are requested by the end user
• Comprehensive use of profile Generator to generate roles and assign roles to end users
• Used SU24 to change authorization object assignment to a transaction code based on requirement.
• Maintained/updated custom USOBT and USOBX table as per business requirements by activating and deactivating authorization checks.
• Mitigation and remediation of users and roles using User/Role Analysis in GRC RAR.
• Determine and report if any risks will be introduced by simulating the addition of transactions. Roles, or Profiles to a User ID.
• Perform controls and reviews for SA, SOD and duplicate id reviews quarterly for auditing purpose.
• Work with end users and line managers to un map any role groups that result in SOD Conflicts
• Generating the Quarterly User Access Report.
• Perform SOD checks in GRC and generate SOD Management Report.
• Fire Fighter assignments as per the business requirements
• Generation of FF daily log audit reports.
• Weekly audit of Fire Fighter for Unique, invalid controllers and common FFIDs
• Implemented SAP Security Best Practices Procedures resulting in dramatic decrease of production support help desk requests.
• Point of Contact for External and Internal Auditors to provide all SAP Security related information, communicate current company policy and procedure documentation, and provide data from SAP Systems for audit analysis.

Confidential

Technical Support Associative

Responsibilities:

• Perform User Administration and role Administration (creating, changing, maintaining user accounts and assigning roles).
• Assigning additional roles to the existing users based.
• Mass Users Maintenance for the business convenience.
• Resetting Passwords for users and intimating password policy.
• Modifying Base Roles and Company Specific Roles based ·
• Created Composite roles based upon request.
• Analyzing User Information System using TCode SUIM.
• Addition, Removal of Transaction Codes, authorizations, authorization objects by modifying existing roles based upon change request.
• Performed Transportation of newly created roles/ modified roles.
• Performed User comparison in PFCG.
• Critical authorization objects such as S TABU DIS, S PROGRAM, S DEVELOP were restricted and monitored.
• Analyzing authorization checks & troubleshooting Security problems using ST01 and SU53.