4 Hana Access Control

Mahesh Nalla

LEAD SAP S/* HANA security and GRC administrator.

SAP Administration and IT Auditor.

Email: ad5rsy@r.postjobfree.com

Phone: 937-***-****

Location: Texas, USA

LinkedIn: https://www.linkedin.com/in/mahesh-n-0134028a/

Certifications:

SAP Certified Application Associate - SAP Access Control 12.0:

Certified MS Excel

Competencies:

Professional Summary:

Landing in the world of SAP SECUIRTY after successful 9+ Years of experience of being SAP S/4 HANA security and GRC administration, leading a team size of 7. In the extra ordinary process of working on Implementation, upgrades, migration, roll -out and support projects, developed deep interest towards the security which motivated to volunteer in various SAP security activities. With the strong decision and administration in multiple products including SAP ECC SECURITY, SAP GRC ACCESS CONTROL, SAP S/4 HANA FIORI SECUURITY, SAP BW, SAP BTP & INTERNAL IT AUDITOR.

Analytical LEAD SAP security equipped with in-depth understanding of security risks associated with range of organizational actions. Focused on helping clients limit or balance risk against reward for optimal decision-making. Easily handles complex data to understand potential impacts, break down risk and develop recommendations. Thorough and meticulous GRC Risk Specialist accomplished in helping organizations manage SOD risk, industry-specific and general economic risks. Detail-oriented in reviewing data and identifying impactful trends. Brings great presentation and interpersonal communication skills. Detail-oriented team player with strong organizational skills. Ability to handle multiple projects simultaneously with a high degree of accuracy. Hardworking and passionate job seeker with strong organizational skills eager to secure SAP ECC S/4 HANA GRC FIORI IAG SAC BTP BW security position. Ready to help team achieve company goals. Successful at reviewing suspicious activities and uncovering fraud. Excellent reporting and documentation skills.

I am an Internal IT Audit professional with 4+ years primarily specializing in Internal Controls Audit for ITGC and SOX Controls. Ability to design test plans and testing approaches based on risk analysis and cover the process walkthrough, test of design (TOD) and test of operation efficiency (TOE), remediation measures. Ability to evaluate findings based on factors identified by SOX process owners, internal audit function, management, and our external auditors to assess internal control. Perform and document control testing to support the Internal Audit plan and SOX 404 internal control assessment. Communicate identified control deficiencies to management both orally and in writing. Worked on ITGC Controls TOD and TOE for: Logical Access, Change Management and Operations Controls. Knowledge of SOC1 and SOC2 Controls including trust criteria.

Accomplishments:

Successfully implemented GRC system with great client satisfaction.

Used Microsoft Excel to develop tracking spreadsheets and create VBA script for risk analysis.

Supervised team of 5 staff members. Provided strategic and innovative suggestions to clients on scope of enhancements.

Documented and resolved FF log issues and which led to better exposure of FF logs.

Collaborated with team of 3 in the upgrade of GRC SP level.

Perform internal Audit activities every quarter and identify deficiencies and reports with corrective measures.

Received best employee award in 2022.

Participated in GEN AI activities which will help in automation of SAP standard practice with an self-motivated esteem.

Partially supports S/4 HANA brown field implementation.

IAG provisioning testing for cloud connectors and documentation.

Area of Expertise:

SAP S/4 HANA FIORI Security:

Fiori Launchpad Spaces and Pages Migrating Launchpad Groups to Spaces and Pages.

Gateway role design includes Catalogs, Groups and ODATA for FIORI Launchpad.

Participate in the ABAP and FIORI Development and Support of SAP Modules

Backend role design to include T-code, ODATA.

Resolving services authorization issues using trace /N/IWFND/ERROR_LOG.

Assigning back end, front end roles as per the requirement. Creating roles for service apps. Creating role through PFCG for catalogues and app specified Fiori application.

SAP FIORI/Portal skills in Html5, SAPUI5 and tile setup/configuration and customization

S/4 HANA security including Fiori tile and Group development.

GRC AC 12.X Skills:

Experience in 1 full cycle end to end implementation and GRC SP level upgrades.

Using IAG bridge for access provisioning to cloud system like Concur, C4C- Cloud to Customer, CRM.

Guiding basis team for creation of IAG RFC`s for cloud connector HTTP`s to external.

Have wide experience in GRC 12.0 tool for SOD Analysis at User & Role level.

Determining and reporting if any risks are introduced by simulating with addition of Roles to a User ID.

Created Mitigation control and mitigation control owners with approvals. Updating FF ID Owners such as controller and owner with the approver of administrator. Assigning FF IDs to the users in EAM.

Generating FFID reports and sends the same to controller after usage of every FFID. Defined Access control owners & approvers.

Worked on Rule set modifications. Maintaining Configuration parameters as per the requirement for each component in AC.

Importing roles to BRM.

Performed synchronization jobs when required.

Worked on ARM for creating new users through access request creation.

Worked on SOD rule set modifications.

Configure and Good Knowledge on MSMP and BRF+.

Extensive experience in building SOD rulesets as per business needs and understanding SOX compliance.

Worked on ITGC Controls TOD and TOE for: Logical Access, Change Management and Operations Controls.

Ability to design test plans and testing approaches based on risk analysis and cover the process walkthrough, test of design (TOD) and test of operation efficiency (TOE), remediation measures.

Perform and document control testing to support the Internal Audit plan and SOX 404 internal control assessment.

R/3 Security:

Worked on user administration: Creation, lock, Unlock, password reset users based on user request.

Mass user maintenance such as mass user locking, unlocking, and assigning roles to the mass users for the business convenience.

Role administration like designing various kinds of roles (Derived Role, Composite Role and Single Role) as per the business requirement.

Providing Access to the Roles as per the business requirement with proper approval.

Performing the User Trace by ST01 to investigate authorization related issues.

Preparing and analyzing reports in SAP using SUIM, and security related tables.

Working with tables like AGR* & USR*.

Involved in Table level authorizations restriction and Maintained table security using auth groups.

Implemented New business sensitive rulesets for IT users to be compliance with SOX and external audits.

Primarily specializing Internal Controls Audit for ITGC and SOX Controls

Technical skills:

Tools / Environments

SAP ECC, GRC, FORI, S/4 HANA, CPI, SAP SAC, SAP BTP, IT Audit controls, SQL

Operating systems

Windows 2008, windows XP, windows 7, windows 10, VMware ESX 2.x,3, VMware Workstation

Hardware

VMware, Backup Devices, Ethernet Hubs, Routers, Repeaters, Jukebox, Printers DELL PowerEdge 2950, 6400

Web/Application servers

HTTP Server, HTML, XML

Networking

TCP/IP, NIS, NFS, DNS, DHCP, Cisco Routers/Switches, WAN, SMTP, NTP, LAN, MTA, FTP/TFTP

Programming language

C, ABAP, Python and VB Script programming

Formats

Text, XML, JSON, CSV

Project Management:

Task

Remarks

Project planning

Planned execution of GRC upgrade

Demand management

Checked with the possible resource for completion of Upgrade & roll out projects.

Competency Framework

Walk through of the SAP systems to the external auditors. Keep event logs readily available for auditors.

Estimation

Preparing the estimation as per the SOW for minor enhancements

Risk management

Runing UAR and report to the mitigation controller to analysis and mitigate the risk

Scheduling and Tracking

Tracking on the updates of the implementation and updating the deck to the business

Escalation handling

prioritizing customer service concerns, ranking issues based on severity and ensuring that they're addressed by the right reps

Hiring management

Interviewed and analyzed the skill set of the candidate as per the project requirements.

Project activities:

JOB TITLE: LEAD SAP SECURITY & FIORI / GRC CONSULTANT DURATION: 04/2023 – TILL DATE.

Client: PepsiCo, Remote – Texas, USA

PepsiCo is a global food and beverage leader with a product portfolio including 22 brands that generate more than $1 billion each in annual retail sales. Our main businesses - Quaker, Tropicana, Gatorade, Frito-Lay, and Pepsi-Cola - make hundreds of enjoyable foods and beverages that are loved throughout the world.GE is best known for its work in the Power, Renewable Energy, Aviation and health industries.

Roles and Responsibilities:

Project#1: PepsiCo global.

Walkthrough audit members / stake holders across the system and explain the workflow of systems.

Change Management and Operations Control. Perform pre-requisite testing before upgrade.

Building rulesets as per business needs.

Using IAG bridge for access provisioning to cloud system like Concur, C4C- Cloud to Customer, CRM.

Updating project deck and updating client on project status.

Back up of all plugin connector systems, download necessary tables.

Perform UT testing and RT testing for all component activities.

Mapping back all respective connectors after the refresh and upgrade.

Raising OSS to SAP team to find solutions of new dumps after upgrade.

Built automated test scripts to handle repetitive software testing work.

Transportation of new changes made to system as per the upgrade. Upload / update roles into GRC system.

Maintaining SOD controllers and approver at BRF+ table.

Training juniors and mentoring junior staff on SAP system operations and functionality.

Communicating with clients and updating the status of the project.

Delivered SAP training, user support and knowledge transfer at end of project and followed up to verify successful implementation.

Optimizing client business process with string analytic skills and collaboratively working with concerned consulting teams.

Project#2: PepsiCo North America.

Worked on upgrade of GRC from SP 12 to SP 20 for North America projects.

Worked with multiple teams following Agile Scrum processes to adhere the business requirements.

Process improvements to meet the deadline with problem-solving ability.

Understanding the business requirement on new upgrades and enhancement.

Backing up all the relevant tables in GRC system.

Preparing a test script for RT and UAT tests.

Performed UAT test cases with sampling methodology.

Performed RT test cases in pre-prod environments.

Assisted juniors in test case scenarios and helped to debug the issues.

Fixed workflow and stage level issue in MSMP.

ODATA services activation.

Updating the configuration settings in SPRO level.

Defining and redesigning RFC destinations for failed connectors.

ENVIRONMENT: Windows, SAP 7.70, SAP GRC 20.X, SAP FIORI 1.0, IAG, Identity and Access management (IDM), ServiceNow.

JOB TITLE: LEAD SAP SECURITY & GRC CONSULTANT DURATION: 10/2020– 04/2023.

Client: General Electric Company (GE), Remote – Texas, USA

GE is best known for its work in the Power, Renewable Energy, Aviation, and health industries. It deals with multiple applications and ERP tools. One of the major American corporations and one of the largest and most-diversified corporations in the world. GE digital and sap ERP toll are partners to advance Industrial internet of things (IoT).

Roles and Responsibilities:

Team Handling (headcount 7) and reporting to client on projects status.

Understanding the business requirement on new roll out projects and building authorization accordingly in system

Walkthrough audit members across the system and explain the workflow of systems.

Worked on ITGC Controls TOD and TOE for: Logical Access, Change Management and Operations Controls

Building rulesets as per business needs

Finding and Remediating SOD risks at user level / role level.

Built automated test scripts to handle repetitive software testing work.

S/4 HANA security including Fiori tile and Group development.

Implementing new changes in the system to fill the gap identified by audit and keep compliance with SOX.

Performed Transportation of newly created roles/ modified roles using PFCG and SE09, SE10

Authorization checks using transaction SU24 and maintained check indicators for Transaction codes.

Analyzing SU53, ST01 screen shots to debug Authorization problems.

Maintaining SOD controllers and approver at BRF+ table for new project in system

Upload / update roles into GRC system.

Executed and managed over 11 roll out projects successfully to SAP from other ERP tools.

Multitasked and managed multiple deliverables and projects concurrently and facilitated use of SAP for enterprise resource planning.

Working with upgrades and implementation of new IT programs.

SOX Walkthrough across the system and understanding the workflow of complex systems.

ITGC testing’s and audit readiness.

Updating project deck and updating client on project status. • Perform pre-requisite testing’s.

Assessments of SOC1 & SOC2 reports.

Built automated test scripts to handle repetitive software testing work.

ENVIRONMENT: Windows, SAP 7.70, SAP GRC 12.X, SAP FIORI 1.0, IAG, Identity and Access management IDM ServiceNow, IT audit controls.

JOB TITLE: SAP SECURITY DURATION: 07/2014 - 02/2020

Client: MTTL- MOLD-TEK – INDIA.

Mold-Tek Technologies, Inc. belongs to a $70 Million Group. MTTL is one of the Leading Engineering and Technology Solutions partners to many key players in various Engineering services across the globe. It’s the only company listed on (Bombay Stock Exchange & National Stock Exchange) Engineering services provider in India and HQ-Hyderabad.

Roles and Responsibilities:

ECC 6.0 – Role Administration and Role transports, performing weekly, Monthly and Quarterly checks.

Mass user maintenance using SU10, assign roles to the users.

Role administration like Role creation, modification and deleting as per the requirement.

GRC AC 10.x – Replacing and Adding Role Owners, Risk Owners, Controllers, Owners and FF IDs, Performing Risk Analysis, Updating MSMP workflows and BRF+ rules, Importing Roles into BRM on a periodic basis, Troubleshooting Access Requests, Delegating of the Requests, Pulling the reports of New, Change Accounts

FIORI – Role Design for embedded systems, troubleshooting, activation of O-data service, addition of new app into existing FIORI role, Creation of Catalogs, Groups and Tiles.

Making presentations and demonstrations about new features to clients.

Providing guidance and advice to clients facing SAP security related decisions.

Design and implement security Users and Roles in support of customer requirements.

Perform Role Creation, Modification and Full troubleshooting support for the Clients userbase authorization failures in all SAP applications and resolving the Security issues and support in integration testing of Roles/Profiles.

Role Administration and Role transport, performing weekly, Monthly and Quarterly checks.

Mass user maintenance using SU10, assign roles to the users. Role administration like Role creation, modification.

ENVIRONMENT: Windows, SAP 7.70, SAP GRC 12.X, SAP FIORI 1.0, ServiceNow.

Education details:

Degree

Name of the specialization

Year of completion

Post graduate diploma in Business management

Business management

2016-2017

Bachelor of Science

Mechanical engineering

2010-2014

Internal audit & SOX compliance cccompimplementation Adoption

ITGC & ITAC controls

GRC implementation & upgrade

Compliance – SOX, GDPR, HIPPA

Contact this candidate