Senior SAP GRC Security Engineer / Administrator (Remote)

Stage 4 Solutions is seeking a Senior GRC Security Engineer / Administrator for a global aerospace company. In this role, you will design, configure, and support SAP GRC Access Control solutions while collaborating with various teams to ensure secure and compliant SAP environments.

Responsibilities:

• Design, configure, and support SAP GRC Access Control solutions by managing role design, Segregation of Duties (SoD) analysis, risk assessments, user provisioning, compliance, audit support, and SAP security administration while collaborating with business, SAP Basis, and IT security teams to ensure secure and compliant SAP environments
• Business Process, Risk/Ruleset management, and Process Controls Development and Management
• Hands-on experience of leading the business through risk analysis and remediation
• Deep knowledge of SAP GRC components: Access Control (AC), Process Control (PC), Risk Management (RM), and Audit Management (AM)
• Experience configuring and maintaining GRC solutions (role design, SoD rules, workflow setup, remediation)
• Designing, testing, and maintaining composite and single roles
• Managing SoD matrices, risk analysis, and remediation projects
• Using tools such as Access Risk Analyzer (ARA), Role Manager, and Business Role Builder
• Experience with standard engineering process
• Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable
• Experience with software systems design
• Building internal controls, monitoring plans, and audit workpapers
• Configuring continuous control monitoring (CCM) and KPI dashboards
• Conducting risk assessments and documenting control effectiveness
• Understanding of regulatory frameworks (SOX, GDPR, ISO 27001, FISMA, etc.)
• Ability to generate audit ready reports and evidence
• Coordination with internal and external auditors
• Fundamentals of SAP NetWeaver, S/4HANA, and system landscape management
• Transport management (CTS) for GRC objects
• Integration with SAP Identity Management (IdM) and third party IAM solutions
• Proficiency with GRC configuration tools (PFCG, GRAC, GRPC, GRRM)
• Basic ABAP debugging for security related enhancements
• Automation scripts (PowerShell, Python, Bash) for user provisioning and report generation
• Monitoring GRC alerts, handling violations, and executing remediation steps
• Collaboration with SAP Basis and IT security teams for patches and hardening
• Experience leading GRC implementation or upgrade projects (Agile or Waterfall)
• Managing change requests, documentation, and stakeholder communication
• Building regular SoD, risk, and compliance reports (using SAP GRC reporting, Excel, Power BI)
• Analyzing large user role datasets to identify anomalies
• Clear documentation of GRC policies, procedures, and role designs
• Conducting training sessions for functional users and auditors
• Liaising with business owners, security teams, and IT partners
• Strong analytical and problem solving abilities
• High attention to detail and accuracy
• Proactive attitude and willingness to stay current with GRC best practices and regulatory changes

Requirements:

• Must be a U.S. Citizen
• 8+ years of experience as SAP GRC Security Engineer / Administrator
• Bachelor s Degree
• SAP GRC Suite Expertise
• Business Process, Risk/Ruleset management, and Process Controls Development and Management
• Hands-on experience of leading the business through risk analysis and remediation
• Deep knowledge of SAP GRC components: Access Control (AC), Process Control (PC), Risk Management (RM), and Audit Management (AM)
• Experience configuring and maintaining GRC solutions (role design, SoD rules, workflow setup, remediation)
• Access Control (AC)
• Designing, testing, and maintaining composite and single roles
• Managing SoD matrices, risk analysis, and remediation projects
• Using tools such as Access Risk Analyzer (ARA), Role Manager, and Business Role Builder
• Engineering Methodology
• Experience with standard engineering process
• Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable
• Experience with software systems design
• Process Control & Risk Management
• Building internal controls, monitoring plans, and audit workpapers
• Configuring continuous control monitoring (CCM) and KPI dashboards
• Conducting risk assessments and documenting control effectiveness
• Compliance & Audit
• Understanding of regulatory frameworks (SOX, GDPR, ISO 27001, FISMA, etc.)
• Ability to generate audit ready reports and evidence
• Coordination with internal and external auditors
• SAP Basis & Integration
• Fundamentals of SAP NetWeaver, S/4HANA, and system landscape management
• Transport management (CTS) for GRC objects
• Integration with SAP Identity Management (IdM) and third party IAM solutions
• Technical Tools & Scripting
• Proficiency with GRC configuration tools (PFCG, GRAC, GRPC, GRRM)
• Basic ABAP debugging for security related enhancements
• Automation scripts (PowerShell, Python, Bash) for user provisioning and report generation
• Security Incident Management
• Monitoring GRC alerts, handling violations, and executing remediation steps
• Collaboration with SAP Basis and IT security teams for patches and hardening
• Project & Change Management
• Experience leading GRC implementation or upgrade projects (Agile or Waterfall)
• Managing change requests, documentation, and stakeholder communication
• Data Analysis & Reporting
• Building regular SoD, risk, and compliance reports (using SAP GRC reporting, Excel, Power BI)
• Analyzing large user role datasets to identify anomalies
• Communication & Training
• Clear documentation of GRC policies, procedures, and role designs
• Conducting training sessions for functional users and auditors
• Liaising with business owners, security teams, and IT partners
• Soft Skills
• Strong analytical and problem solving abilities
• High attention to detail and accuracy
• Proactive attitude and willingness to stay current with GRC best practices and regulatory changes