Lead SAP Security Functional Consultant

Role overview :

An experienced SAP Security lead consultant is required with deep expertise in SAP authorisations, SAP GRC Access Control, segregation-of-duties governance, and identity-integration architecture to lead complex security and controls delivery across a multi-application SAP landscape for a global dairy and nutrition enterprise. The role extends beyond operational role maintenance and requires ownership of enterprise security design, access-governance strategy, role-model harmonization, audit and compliance readiness, cloud-identity integration, and security support for transformation programmes across ECC, S/4HANA, Fiori, analytics, and cloud-connected applications.

The consultant is expected to operate as a senior functional lead across security, audit, compliance, infrastructure, identity, and business process teams, combining strong hands-on capability with governance of security architecture, control design, risk remediation, release planning, cutover security readiness, and hypercare stabilization.

Key responsibilities :

- Own end-to-end SAP security solution design across ECC, S/4HANA, Fiori, BW or analytics platforms, and connected cloud applications, ensuring scalable and supportable role and authorization architectures.

- Lead enterprise role-design strategy including single, composite, and derived roles; organizational-level restrictions; firefighter and privileged-access models; and harmonized business-role structures aligned to process and control requirements.

- Drive SAP GRC Access Control solution ownership across Access Risk Analysis, Access Request Management, Emergency Access Management, and Business Role Management, including workflow design, ruleset maintenance, mitigating controls, and access-governance operating models.

- Lead segregation-of-duties analysis and remediation across finance, procurement, supply chain, HR, and shared-services processes, balancing control rigor with business continuity and operational practicality.

- Own user-provisioning and access-lifecycle design including joiner-mover-leaver controls, approval matrices, recertification campaigns, role-owner governance, and integration with enterprise identity and access-management platforms.

- Design and support identity integration patterns involving SAP IAS, cloud-connected SAP applications, and enterprise identity providers such as Azure Entra ID, ensuring authentication, provisioning, and governance alignment across hybrid landscapes.

- Provide security design leadership for new SAP rollouts, enhancements, migrations, and transformation initiatives, including Fiori enablement, S/4HANA conversions, analytics security, and cloud-application onboarding.

- Act as the primary functional escalation point for production-critical access issues, SoD conflicts, provisioning failures, emergency-access gaps, audit findings, and cross-platform security inconsistencies, with structured root-cause analysis and corrective-action tracking.

- Prepare detailed functional specifications, role-design documentation, security concepts, control matrices, remediation plans, test evidence, and audit-support artifacts; govern delivery quality across internal teams and third-party partners.

- Lead fit-gap discussions, security workshops, role-mapping exercises, integration testing, UAT support, cutover security readiness, hypercare activities, and transition into steady-state support.

- Partner with audit, compliance, internal controls, privacy, infrastructure, BASIS, and business stakeholders to define sustainable control frameworks, governance standards, and risk-based access models.

- Mentor junior consultants and administrators, review role designs, establish documentation and review standards, and provide leadership in design forums, risk committees, and change-governance meetings.

Mandatory skills :

SAP Security and authorizations :

- Deep hands-on expertise in SAP authorization concepts across ECC and S/4HANA, including role design, authorization objects, organizational values, derived-role strategy, Fiori catalogs and spaces or groups, and analytics-security considerations.

- Strong capability in designing scalable security models for business-process-intensive environments with strict audit, traceability, and access-control expectations.

SAP GRC Access Control :

- Strong experience across SAP GRC Access Control modules including ARA, ARM, EAM, and BRM, with practical ownership of SoD rulesets, mitigation controls, access workflows, firefighter governance, and recertification controls.

- Ability to align GRC design with enterprise internal-control objectives, audit expectations, and operational-access requirements across multiple functions.

Identity and cloud integration :

- Strong working knowledge of SAP IAS, SuccessFactors or cloud-application security, Azure Entra ID integration, and hybrid identity-governance patterns for authentication and access lifecycle control.

- Exposure to SAP IAG, SAP IdM, or adjacent cloud-governance capabilities is highly desirable in modern SAP security landscapes.

Implementation and leadership :

- Proven experience in at least two full-lifecycle SAP security or GRC implementations, major rollouts, or transformation programmes, with additional ownership in AMS stabilization and controls remediation.

- Demonstrated ability to lead security and controls workshops, challenge weak access designs, define scalable global role concepts, and govern execution across onsite, offshore, and third-party teams.

- Strong experience with change governance, transport and release coordination, defect triage, audit-preparation support, cutover planning, and service transition.

Domain expectations :

- Experience in dairy, food, nutrition, FMCG, or adjacent regulated industries with strong needs for finance and procurement control integrity, audit readiness, and cross-functional segregation of duties.

- Practical understanding of data-privacy awareness, compliance discipline, and the impact of access risks on sensitive operational and financial processes.

- Ability to support secure operating models in global, multi-vendor, and multi-application enterprise environments.

Preferred qualifications :

- SAP Security or GRC certification is preferred.

- Exposure to SAP IAG, SAP IdM, cloud identity governance, and S/4HANA security transformation programmes is a strong plus.

- Experience supporting Fiori security, analytics security, and hybrid IAM modernization initiatives is desirable.

Soft skills :

- Excellent stakeholder management, workshop facilitation, structured communication, and executive-level documentation capability.

- Strong analytical problem solving, ownership mindset, delivery rigor, and ability to operate effectively in a fast-paced global support and transformation environment.

- Ability to balance security control rigor with business usability, operational continuity, and programme delivery needs.

(ref:hirist.tech)