Lead SAP Security Functional Consultant

Role overview :An experienced SAP Security lead consultant is required with deep expertise in SAP authorisations, SAP GRC Access Control, segregation-of-duties governance, and identity-integration architecture to lead complex security and controls delivery across a multi-application SAP landscape for a global dairy and nutrition enterprise. The role extends beyond operational role maintenance and requires ownership of enterprise security design, access-governance strategy, role-model harmonization, audit and compliance readiness, cloud-identity integration, and security support for transformation programmes across ECC, S/4HANA, Fiori, analytics, and cloud-connected applications.The consultant is expected to operate as a senior functional lead across security, audit, compliance, infrastructure, identity, and business process teams, combining strong hands-on capability with governance of security architecture, control design, risk remediation, release planning, cutover security readiness, and hypercare stabilization.Key responsibilities :- Own end-to-end SAP security solution design across ECC, S/4HANA, Fiori, BW or analytics platforms, and connected cloud applications, ensuring scalable and supportable role and authorization architectures.- Lead enterprise role-design strategy including single, composite, and derived roles; organizational-level restrictions; firefighter and privileged-access models; and harmonized business-role structures aligned to process and control requirements.- Drive SAP GRC Access Control solution ownership across Access Risk Analysis, Access Request Management, Emergency Access Management, and Business Role Management, including workflow design, ruleset maintenance, mitigating controls, and access-governance operating models.- Lead segregation-of-duties analysis and remediation across finance, procurement, supply chain, HR, and shared-services processes, balancing control rigor with business continuity and operational practicality.- Own user-provisioning and access-lifecycle design including joiner-mover-leaver controls, approval matrices, recertification campaigns, role-owner governance, and integration with enterprise identity and access-management platforms.- Design and support identity integration patterns involving SAP IAS, cloud-connected SAP applications, and enterprise identity providers such as Azure Entra ID, ensuring authentication, provisioning, and governance alignment across hybrid landscapes.- Provide security design leadership for new SAP rollouts, enhancements, migrations, and transformation initiatives, including Fiori enablement, S/4HANA conversions, analytics security, and cloud-application onboarding.- Act as the primary functional escalation point for production-critical access issues, SoD conflicts, provisioning failures, emergency-access gaps, audit findings, and cross-platform security inconsistencies, with structured root-cause analysis and corrective-action tracking.- Prepare detailed functional specifications, role-design documentation, security concepts, control matrices, remediation plans, test evidence, and audit-support artifacts; govern delivery quality across internal teams and third-party partners.- Lead fit-gap discussions, security workshops, role-mapping exercises, integration testing, UAT support, cutover security readiness, hypercare activities, and transition into steady-state support.- Partner with audit, compliance, internal controls, privacy, infrastructure, BASIS, and business stakeholders to define sustainable control frameworks, governance standards, and risk-based access models.- Mentor junior consultants and administrators, review role designs, establish documentation and review standards, and provide leadership in design forums, risk committees, and change-governance meetings.Mandatory skills :SAP Security and authorizations :- Deep hands-on expertise in SAP authorization concepts across ECC and S/4HANA, including role design, authorization objects, organizational values, derived-role strategy, Fiori catalogs and spaces or groups, and analytics-security considerations.- Strong capability in designing scalable security models for business-process-intensive environments with strict audit, traceability, and access-control expectations.SAP GRC Access Control :- Strong experience across SAP GRC Access Control modules including ARA, ARM, EAM, and BRM, with practical ownership of SoD rulesets, mitigation controls, access workflows, firefighter governance, and recertification controls.- Ability to align GRC design with enterprise internal-control objectives, audit expectations, and operational-access requirements across multiple functions.Identity and cloud integration :- Strong working knowledge of SAP IAS, SuccessFactors or cloud-application security, Azure Entra ID integration, and hybrid identity-governance patterns for authentication and access lifecycle control.- Exposure to SAP IAG, SAP IdM, or adjacent cloud-governance capabilities is highly desirable in modern SAP security landscapes.Implementation and leadership :- Proven experience in at least two full-lifecycle SAP security or GRC implementations, major rollouts, or transformation programmes, with additional ownership in AMS stabilization and controls remediation.- Demonstrated ability to lead security and controls workshops, challenge weak access designs, define scalable global role concepts, and govern execution across onsite, offshore, and third-party teams.- Strong experience with change governance, transport and release coordination, defect triage, audit-preparation support, cutover planning, and service transition.Domain expectations :- Experience in dairy, food, nutrition, FMCG, or adjacent regulated industries with strong needs for finance and procurement control integrity, audit readiness, and cross-functional segregation of duties.- Practical understanding of data-privacy awareness, compliance discipline, and the impact of access risks on sensitive operational and financial processes.- Ability to support secure operating models in global, multi-vendor, and multi-application enterprise environments.Preferred qualifications :- SAP Security or GRC certification is preferred.- Exposure to SAP IAG, SAP IdM, cloud identity governance, and S/4HANA security transformation programmes is a strong plus.- Experience supporting Fiori security, analytics security, and hybrid IAM modernization initiatives is desirable.Soft skills :- Excellent stakeholder management, workshop facilitation, structured communication, and executive-level documentation capability.- Strong analytical problem solving, ownership mindset, delivery rigor, and ability to operate effectively in a fast-paced global support and transformation environment.- Ability to balance security control rigor with business usability, operational continuity, and programme delivery needs. (ref:hirist.tech)