SAP Security Specialist

PlanIT Group, LLC; Orlando (FL); On-site; USD 110,000 - 150,000; Full time

Job summary

PlanIT Group, LLC is seeking an SAP GRC Engineer / Admin in Orlando to design and manage SAP GRC controls, access, and remediation. You will lead risk analyses, build CCM/ dashboards, and coordinate with auditors and IT security to ensure compliant environments.

The role requires hands-on experience with AC, PC, RM, and AM components, as well as proficiency in GRC tools (PFCG, GRAC, GRPC, GRRM) and scripting for automation. Strong communication with business owners is essential.

Qualifications

• Deep knowledge of SAP GRC components across AC/PC/RM/AM.
• Experience configuring and maintaining GRC solutions with role design and remediation.
• Ability to lead risk analysis and remediation with business stakeholders.
• Proven experience in generating audit-ready evidence and reports.

Responsibilities

• Design, test, and maintain SAP GRC roles and access controls.
• Lead risk analysis, remediation projects, and SoD deconfliction.
• Configure CCM and KPI dashboards for ongoing controls.
• Collaborate with auditors and IT security for patches and hardening.
• Translate business requirements into technical GRC deliverables.
• Prepare risk assessments and document control effectiveness.

Skills

SAP GRC components (AC, PC, RM, AM)

Risk analysis

SoD matrices

Audit readiness

Role design and SoD remediation

Tools

PFCG

GRAC

GRPC

GRRM

ABAP debugging (security)

PowerShell

Python

Bash

SAP Identity Management (IdM)

Job description

Job Description: This role is for an SAP GRC Engineer / Admin

SAP GRC Suite Expertise

• Business Process, Risk/Ruleset management, and Process Controls Development and Management
• Hands-on experience of leading the business through risk analysis and remediation
• Deep knowledge of SAP GRC components: Access Control (AC), Process Control (PC), Risk Management (RM), and Audit Management (AM)
• Experience configuring and maintaining GRC solutions (role design, SoD rules, workflow setup, remediation)

Access Control (AC)

• Designing, testing, and maintaining composite and single roles
• Managing SoD matrices, risk analysis, and remediation projects
• Using tools such as Access Risk Analyzer (ARA), Role Manager, and Business Role Builder

Engineering Methodology

• Experience with standard engineering process
• Background in doing requirements discovery and translation from business requirements to technical requirements / deliverable
• Experience with software systems design

Process Control & Risk Management

• Building internal controls, monitoring plans, and audit workpapers
• Configuring continuous control monitoring (CCM) and KPI dashboards
• Conducting risk assessments and documenting control effectiveness

Compliance & Audit

• Understanding of regulatory frameworks (SOX, GDPR, ISO 27001, FISMA, etc.)
• Ability to generate auditready reports and evidence
• Coordination with internal and external auditors

SAP Basis & Integration

• Fundamentals of SAP NetWeaver, S/4HANA, and system landscape management
• Transport management (CTS) for GRC objects
• Integration with SAP Identity Management (IdM) and thirdparty IAM solutions

Technical Tools & Scripting

• Proficiency with GRC configuration tools (PFCG, GRAC, GRPC, GRRM)
• Basic ABAP debugging for securityrelated enhancements
• Automation scripts (PowerShell, Python, Bash) for user provisioning and report generation

Security Incident Management

• Monitoring GRC alerts, handling violations, and executing remediation steps
• Collaboration with SAP Basis and IT security teams for patches and hardening

Project & Change Management

• Experience leading GRC implementation or upgrade projects (Agile or Waterfall)
• Managing change requests, documentation, and stakeholder communication

Data Analysis & Reporting

• Building regular SoD, risk, and compliance reports (using SAP GRC reporting, Excel, Power BI)
• Analyzing large userrole datasets to identify anomalies

Communication & Training

• Clear documentation of GRC policies, procedures, and role designs
• Conducting training sessions for functional users and auditors
• Liaising with business owners, security teams, and IT partners

Soft Skills

• Strong analytical and problemsolving abilities
• High attention to detail and accuracy
• Proactive attitude and willingness to stay current with GRC best practices and regulatory changes