Security Sap

KRISHNA MOHAN CHARUGUNDLA

SAP Security and GRC Consultant

E-Mail: ******@*****.***

Mobile: 309-***-****

SUMMARY:

•9+ years of experience in the context of SAP ECC Security and GRC Access Control.

•Profile Generator (PFCG), Role creation, Profile creation, modifications, User Administration, Central User Administration (CUA), Authorization objects, User reconciliation, CATT Scripts, User locks and password maintenance, knowledge of AIS (Audit Information System).

•Expert in development and administration of SAP Application Security in ECC and R/3 environment for the modules of SD, MM, FI, CO, PP, PM,AM,WM, PS, IM, BASIS, HR, CRM, BW, SCM, SRM/EBP, Enterprise Portals, XI and Solution Manager

•Strong knowledge in SAP T Codes, Authorizations, Authorization Object from 4.7 to ECC 6.0

•SAP HR authorizations with Structural & Context Based Authorizations Implementation.

•Experienced in User Provisioning to profiles in R/3

•VISTEX – US - Chargeback’s & Rebates security support.

•Handling high level client meetings for various projects

•Responsible for deliverables of agreed upon SLA’s with the clients.

•Working knowledge in analyzing and processing SOD issues using the GRC access control tools such as Access Risk Analysis (ARA) formerly known as Risk Analysis and Remediation (RAR), Emergency Access Management (EAM) formerly known as Super user Privilege Management (SPM)/Firefighter, Access Request Management (ARM) formerly known as Compliance User Provisioning (CUP), and Business Role Management (BRM) formerly known as Enterprise Role Management (ERM).

•Good Experience in Role Based Authorizations

•Extensively performed and monitored PFUD, SUPC, SUIM, SU53, SU56, ST01 SCC1, SU53,SE09/SE10.Used CATT Scripts for creating mass users.

•OSS User & Authorizations Administration

•Expert in communicating effectively across the organization and integrating work across relevant areas. Creating manuals and documents for End-User training.

•Expert in developing and executing business plans and Collaborate with other team members and business representatives to ensure that security settings meet the requirements of the business and align with the defined process controls and standards.

•Experience with User Acceptance Testing (UAT)

•Experience in various phases of many upgrades and implementations, as well as strengths in encouraging team unity and direction, supporting good communication between team members and clients, and writing clear, reader-friendly documentation

•Analytical Capability in defining As-Is Processes and proposing To-Be Processes.

•Experience of working in compliance with all Internal & External – Statutory Audit Teams.

•Proficient in documenting business requirements, performing application design activities like writing functional designs & technical designs, Security Re-design, and segregation of duties (SOD) remediation projects, Post Implementation support, Test, and deploy activities.

•Completed 1 full life cycle implementation project in different roles ranging from technical reviews, and module consultant to expert guidance in integration.

•Experience in complete Life cycle Implementation of Security projects i.e. from designing to the production with Go-Live phase.

•Exposure to BIW, APO, MI, PI, Gateway, EREC, Support Desk Authorizations

•Extensive experience in functional modules – MM, SD, QM, HR, FI, MDM, CRM, SRM.

•Extensively with Sarbanes-Oxley (SOX), Internal Audit, and External Audit teams for SAP systems compliance activities

•Strong personal computer skills, including Microsoft Office

QUALIFICATION SUMMARY

Bachelor’s Degree in Commerce - Kakatiya University, India.

TECHNICAL SKILLS:

SAP Skills : SAP Security

ERP Package : SAP ECC 6.0 BW 3.5, BI 7.1, GRC AC 5.3 /10.1,

SAP PLM 4.0, SAP SEM 7.1, SAP EP 7.3, SAP SCM 5.0, SAP CRM 5.0, SAP

SRM 7.1

SAP NW MI 7.1, SAP E-Recruitment 6.0 and SAP Solution Manager 7.0

Tools : Digital Forms, Incident Management

GUI : SAP GUI

Database : Oracle (9i, 10g), MS SQL

Operating System : Windows 7, Windows Vista/XP

PROFESSIONAL EXPERIENCE

Company : Accenture Services Pvt Limited

Client: Dr. Reddy’s Laboratories Limited

Project: SAP GRC 10.0 Access Control-Support Project

Period: February 2015 to Till Date

SAP SW Landscape: ECC 6.0; SAP GRC 5.3 & SAP GRC 10.0

Dr. Reddy's Laboratories, is a multinational pharmaceutical company. Dr. Reddy's manufactures and markets a wide range of pharmaceuticals in India and overseas. Dr. Reddy's Laboratories Limited is an integrated global pharmaceutical company that is engaged in providing medicines. The Company operates in three segments: Global Generics, Pharmaceutical Services and Active Ingredients (PSAI), and Proprietary Products.

Role: Consultant / SAP Netweaver Security / GRC ARA & EAM Administrator

Responsibilities:

Involved in Pre and Post Installation activities of GRC AC 10.0

Maintenance of Access Control Components.

RFC Creations

Worked on Emergency Access Management (EAM) like assignment of FIRE FIGHTER ID’s to the user and changing the validity of ID request & generating log reports.

Maintenance of Templates and Notification messages as per client requirement Creation / Generation of Custom Rule Set

Run Risk Analysis at User / Role Level

Maintenance of Functions / Risks and Mitigation Controls.

Continuously improved security configuration to reflect best practices and prepare for system audits. Tested and implemented security recommendations given by SAP audit team. SAP GRC Access Controls 10.0 (ARA, EAM)

Responsible for design, develop, test and implementation of Access Controls capabilities

Review, validate the SAP system landscape for Access Controls capabilities.

Custom Authorization maintenance.

Responsible for gathering the requirements for complete GRC Access Controls capabilities.

Change Control Management (CCM)

Analyzing SU53, ST01 screen shots to debug Authorization problems.

Sarbanes Oxley Compliance - SAP System Audit and documentation of significant Processes and controls. Complete overall support includes design and implementation for all Security needs for all user ID admin and Role builds for SOX compliance

Maintaining SOD’s.

Minimizing the SOD’s as Zero as per the Client Audit Requirement

Ensuring the SOD’s not getting increasing.

Responsible for support pack upgrades from lower to higher for open technical issues if require.

User and Role Admin in ECC

Experience in SAP HANA Security which includes creation of user id’s, Designed and created Analytical privileges, catalogue roles, design time roles and Granting Privileges to Roles for HANA DB objects by using HANA Studio, Analysed authorization issues

Supporting in Process Control.

Creation / Maintenance of roles in ECC

Processing tickets as per the privileges of the client (SLA).

Client: Dr. Reddy’s Laboratories Limited.

Project : SRM Vikreta Connect

Period: March 2014 to January 2015

Role : Consultant / SAP NetWeaver Security

SAP SW Landscape: ECC 6.0; SAP SRM 7.1

Dr. Reddy's Laboratories, is a multinational pharmaceutical company. Dr. Reddy's manufactures and markets a wide range of pharmaceuticals in India and overseas. Dr. Reddy's Laboratories Limited is an integrated global pharmaceutical company that is engaged in providing medicines. The Company operates in three segments: Global Generics, Pharmaceutical Services and Active Ingredients (PSAI), and Proprietary Products.

Role: Consultant / SAP Netweaver Security Lead

Responsibilities:

Responsible for all aspects of SAP Security Administration tasks including Coordinating and interacting with business, technical and functional consultants for gathering SAP Security requirements, role development (Single Role, Composite Role and Master/Derived Role), create/maintain analysis authorization, testing, transport roles/authorizations, Security system parameter validation, generating analysis reports, troubleshoot authorization error and create/maintain SAP Security process documents for SAP systems ECC6, SRM and Enterprise Portal 7.3

Applied SAP Security policy / procedure / best practices and system controls to SAP systems

User Administration/Maintenance - Central User Administration (CUA) : Creating users, assigning roles to users, resetting password, locking/unlocking users, text comparison for child systems (SU01, SU10, SCUA, SCUL, SCUG, SCUM, RSDELCUA, ST01, SALE in all SAP systems.

Troubleshoot user roles, tracing the users, security authorization objects and custom reporting authorization objects to debug/troubleshoot an authorization error, resolving the issue by giving required authorizations in SAP modules

Attended change control management meeting in respect to security changes and transports.

Used Central User Administration tool for User Administration/maintenance.

Created training IDs and help training team for every phase of implementation and future enhancements.

Used Remedy System for Incident and Change Management.

Extensively worked on production tickets and requests, first (P1), second (P2) and third level support, fixing end user Roles/Profiles based on change requests created for breaks/fixes.

Provided knowledge transfer (KT) and training to off-shore/on-site resources for the entire security design/development and maintenance process.

Responsible for communication, coordination, and teamwork within the team and end users.

Monitor and report to management on the status of project efforts, anticipating/identifying issues…etc

Client: Dr. Reddy’s Laboratories Limited.

Project: APO

Role: SAP Netweaver Security Consultant

Period: March 2013 to February 2014

SAP SW Landscape: ECC 6.0; SAP APO 7.1

Dr. Reddy's Laboratories, is a multinational pharmaceutical company. Dr. Reddy's manufactures and markets a wide range of pharmaceuticals in India and overseas. Dr. Reddy's Laboratories Limited is an integrated global pharmaceutical company that is engaged in providing medicines. The Company operates in three segments: Global Generics, Pharmaceutical Services and Active Ingredients (PSAI), and Proprietary Products.

Role: Consultant / SAP Netweaver Security Lead

Responsibilities:

Sap Security Approach- high level design

R3 Security Strategy and Architecture

Authorization groups functional tables, custom development authorization solutions

Implementing and reviewing SAP Authorization Concept

Portal Security Strategy

BI, CRM, SRM Security Strategy, HCM

Sap Security Integration

Portal, BI, APO, R3 roles and integration

Troubleshoot user roles, tracing the users, security authorization objects and custom reporting authorization objects to debug/troubleshoot an authorization error, resolving the issue by giving required authorizations in SAP modules

Testing, Cut Over and "Go life"

Client: Dr.Reddy’s Laboratories.

Project Name: SAP Security – HR Authorizations

Role: SAP Netweaver Security Consultant

Period: March 2012 to February 2013

SAP SW Landscape: ECC 6.0, SAP GRC 5.3

Responsibilities

SAP HR Security design using structural authorizations (HR-ORG) for Germany HR

Implemented Double Verification Symmetric Principle across HR leads in HCM

Implemented HR Security for Germany Data Protection Work Council for Personnel Data

Implemented HR Security against Data Protection Work Council for Organization Mgmt

Worked with Critical authorization objects like S_TABU_DIS,S_PROGRAM & S_DEVELOP

Blueprinting Security for Talent Management – India

Implemented & Maintained Structural Authorization.

Period of Responsibility & Time Logic Implementation.

Context Dependent Authorization Implementation.

Authorization framework for Controlling Payroll Activities.

Designed security for Appraisal System.

Maintained authorizations for Personnel Development & Training.

Implemented authorization concept for Time & Shift Management

SAP Org Visualization by Nakisa - OrgChart & Org Planning

Testing, Cut Over and "Go life"

Client: Dr.Reddy’s Laboratories.

Project Name: Audit Management

Role: SAP Netweaver Security Consultant

Period: January 2011 to February 2012

SAP SW Landscape: ECC 6.0

Description : Company plans to implement a new version of Audit Management in QM

Module in SAP this is implemented for India business.

Responsibilities

Phase1 Deliverables:

Initially Assign respective Standard Roles & Authorizations module wise to Project teams to permit them login, work & develop in all systems.

Later Refinement needs to be done for those standard roles to have accurate access & close all sec holes as possible.

Determine/Identify Scale and Scope of Authorization Requirements for SAP Security implementation.

Understanding security policy in organization if any to consider into security project.

Identify if there is any need to additional security infrastructure like AD, Identity Mgmt, GRC …etc based on Phase1 experience.

Phase2 Deliverables:

Determine What level of security does SAP data require in organization.

Define Roles & Authorization Implementation Framework & detailed SAP Security Design for Client.

Define User access process / user groups / user admin procedure, Naming conventions, Password policies.

Prepare Enterprise-Wide Role Matrix for all SAP applications in scope

Collect & consider Organization security policies & Compliances if any in place

Transactions list

Reports list

Menu paths, levels of navigation, tabs, and accessible content

Transactions to Role Mapping

Role to users or user groups Mapping

Organizational levels

Design, Develop & Test Roles.

Draft a Security Organization Hierarchy, Role Owners, Approval process for changes.

Define Security Roles change Mgmt process.

Define User Administration process.

Go-live

Handover of Security Role Matrix and Other operational security documents.

Client: Dr.Reddy’s Laboratories.

Project Name: SOD Conflicts - SoX

Role: SAP Netweaver Security Consultant

Period: January 2011 to February 2012

SAP SW Landscape: ECC 6.0

Description : SOD Conflicts removed as per top management required and met the audit

Requirements.

Responsibilities

Mapping the business requirements to realize the business plants.

Involved in testing from Unit/application/string testing etc.

New Roles creations.

Role based authorizations to all the Users.

Maintaining SOD’s.

Minimizing the SOD’s as Zero as per the Client Audit Requirement

Ensuring the SOD’s not getting increasing.

Enabled the new process while providing the authorizations to check the SOD’s and get minimize the risk.

Client: Dr.Reddy’s Laboratories

Project Name: Bristol – USA – New Company Code migration.

Role: SAP Netweaver Security Consultant

Period: August 2011 to December 2011

SAP SW Landscape: ECC 6.0

Responsibilities

Mapping the business requirements to realize the business plants.

Involved in testing from Unit/application/string testing etc.

User Ids Creations.

New Roles creations.

Role based authorizations to all the Users.

Maintaining SOD’s.

Determine What level of security does SAP data require in organization.

Define Roles & Authorization Implementation Framework & detailed SAP Security Design for Client.

Define User access process / user groups / user admin procedure, Naming conventions, Password policies.

Prepare Enterprise-Wide Role Matrix for all SAP applications in scope

Collect & consider Organization security policies & Compliances if any in place

Transactions list

Reports list

Menu paths, levels of navigation, tabs, and accessible content

Transactions to Role Mapping

Role to users or user groups Mapping

Organizational levels

Design, Develop & Test Roles.

Draft a Security Organization Hierarchy, Role Owners, Approval process for changes.

Define Security Roles change Mgmt process.

Define User Administration process.

Go-live

Handover of Security Role Matrix and Other operational security documents.

Client: Dr.Reddy’s Laboratories

Project Name: Aurigene Hyderabad & Bangalore New Company Code in INDIA

Role: SAP Netweaver Security Consultant

Period: April 2010 to July 2011

SAP SW Landscape: ECC 6.0

Responsibilities

Determine What level of security does SAP data require in organization.

Define Roles & Authorization Implementation Framework & detailed SAP Security Design for Client.

Define User access process / user groups / user admin procedure, Naming conventions, Password policies.

Prepare Enterprise-Wide Role Matrix for all SAP applications in scope

Collect & consider Organization security policies & Compliances if any in place

Transactions list

Reports list

Menu paths, levels of navigation, tabs, and accessible content

Transactions to Role Mapping

Role to users or user groups Mapping

Organizational levels

Design, Develop & Test Roles.

Draft a Security Organization Hierarchy, Role Owners, Approval process for changes.

Define Security Roles change Mgmt process.

Define User Administration process.

Go-live

Handover of Security Role Matrix and Other operational security documents.

Client: Dr.Reddy’s Laboratories

Project Name: Cuernavaca plant New Company Code in MEXICO - New Company migration.

Role: SAP Netweaver Security Consultant

Period: April 2009 to March 2010

SAP SW Landscape: ECC 6.0

Responsibilities

Determine What level of security does SAP data require in organization.

Define Roles & Authorization Implementation Framework & detailed SAP Security Design for Client.

Define User access process / user groups / user admin procedure, Naming conventions, Password policies.

Prepare Enterprise-Wide Role Matrix for all SAP applications in scope

Collect & consider Organization security policies & Compliances if any in place

Transactions list

Reports list

Menu paths, levels of navigation, tabs, and accessible content

Transactions to Role Mapping

Role to users or user groups Mapping

Organizational levels

Design, Develop & Test Roles.

Draft a Security Organization Hierarchy, Role Owners, Approval process for changes.

Define Security Roles change Mgmt process.

Define User Administration process.

Go-live

Handover of Security Role Matrix and Other operational security documents.

Client: Dr.Reddy’s Laboratories.

Project Name: Aurigen SAP Security [Standard] – RUN Operations

Role: SAP Netweaver Security Consultant

Period: April 2007 to March 2009

SAP SW Landscape: ECC 6.0

Responsibilities

Creating users, user groups

Creating & Maintaining Various types of Roles

Assignment of Authorizations using direct & Indirect assignment

Creating & assigning Area menu's & SAP Menus

Creating & securing tables with Auth groups

Authorization trace using ST01

Configuring & Maintain Central user administration

Checking / Activating / Displaying Table Logging

Filling Authorization in a New / Upgraded SAP System

User Security Audit Tools - Usage & Configuring

License Administration Workbench

Impermissible Passwords Maintenance

Working with Systems Trace & Audit Traces

Working with Audit Information Systems

Working with Password control & Password security frameworks

EMPLOYMENT HISTORY

Sr.Analyst-SAP Netweaver Security Consultant- Accenture Services- Feb’2015-till date

SAP Netweaver Security Consultant -Dr.Reddy’s Laboratories Ltd-Jan’2006-Jan’2015

SAP MM Consultant & Warehouse Lead- Medicon Galancials Ltd- Sep’2005- Dec’2005

ACHIEVEMNETS

Awarded – Champion Trophy Award received for project UCB Rollout.

Awarded – Star of the Month Award received for Best Support and handling the ticket without SLA

Awarded – Top Performer for making Segregation of Duties (SOD) as “0” in compliance from CFO.

Awarded – Chairman’s Excellence Award received for project BRITOL mySAP implementation.

Recognition – Cross Functional Team appreciation received from Formulation Quality Business.

Awarded – Certificate of Merit for Excellence in Collaboration & Team work.

(This is awarded to Cuernavaca, Mexico mySAP implementation)

Contact this candidate