Senior SAP Security Consultant

• Experience in SAP support and implementation projects in ECC 6.0, GRC AC 12, S/4 Hana and Fiori Security
• Worked in NetWeaver portal administration and ticketing service tool like ServiceNow
• User administration and role administration
• Well versed with SU24/SU25 concepts and analyzed system traces using ST01, STAUTHTRACE and SU53
• Analyzed user master records for roles and authorizations using SUIM and AGR* / USR* tables to assign proper roles

SAP GRC (Access Control):

• Used ARM in GRC 12.0 to create user access requests for new users and additional access
• Identified SOD risks while provisioning access to users
• Analyzed risk-causing factors at critical actions and critical permissions
• Performed remediation and mitigation of risks
• Worked on GRC access control components like ARA, EAM and ARM
• Conducted UAT for ARA and EAM
• Defined admin delegation, role owners and firefighter owners
• Imported roles into BRM and configured MSMP

SAP Fiori Security:

• Created Fiori catalogs, groups, spaces and pages based on requirements and assigned them to end user and support roles
• Updated Fiori roles based on changes in catalogs by developers
• Troubleshot missing tiles in user Fiori launchpad by adding relevant roles in backend Fiori SAP system
• Understood various types of Fiori apps (transactional, analytical, factsheets)

Client: Merck India

• Used tables like AGR_USERS, AGR_TCODES, AGR_AGRS and AGR_DEFINE for reporting
• Provided day-to-day technical support and resolution of security issues
• Maintained role matrices for roles and authorization objects to track modifications
• Extensively used SU53 and STAUTHTRACE to analyze authorization errors
• Created single, composite and derived roles and assigned roles to users
• Modified existing roles based on requirements
• Created users, locked and unlocked users, reset passwords and extended validity dates
• Performed transportation of newly created and modified roles
• Attended complaint calls, performed troubleshooting and daily problem solving
• Conducted authorization checks using transaction SU24 and maintained check indicators for transaction codes
• Performed user and role analysis under risk analysis and remediation to identify SOD violations
• Used ARA to produce analytical reports on users, user groups, roles and profiles with real-time data and offline history
• Defined role owners, approvers, user access approvers, risk owners and mitigation monitors