Sap Security Specialist

Mallikarjun Reddy Thota E-mail: *****.**********@*****.***

SAP Security and GRC Consultant Mobile : +1-437-***-**** Career Objective

Solutions-oriented IT Security Specialist with notable success directing a broad range of corporate IT initiatives while participating in planning and implementation of information-security solutions in direct support of business objectives. Professional Summary

Having 5.8 years of experience as SAP Security Design, Implementation and Support.

Currently working as a SAP Security & GRC Consultant in SAP various systems including ECC 6.0, GRC Access Control 10.1, 12.0 and HANA.

Extensive working knowledge in SAP R/3, GRC, HANA STUDIO and FIORI Environments.

Hands-on on Integrated Business Planning (IBP) and SAP Analytics Cloud Security (SAC).

End-to-End Implementation in GRC 10.1

Audit Support

Technical Skills

SAP ECC 6.0 Experience:

Responsible for day to day technical support and resolution of security issues.

Troubleshooting R/3 security problems.

Strong experience in User Administration (creation of users, deletion of users, locking & unlocking of users, password resetting).

Expertise in using Profile Generator (PFCG) for Creation of roles (Single, Composite, Derived).

Worked with AGR* tables.

Analyzing Missing Authorizations by using SU53 & ST01.

Experienced on Table Security by assigning authorization groups and maintaining Authorization object.

Maintaining check indicators for T-codes in SU24 as per the request. GRC AC 10.1 Experience:

Activation of BC Sets for Workflow, ARA, EAM, ARM & BRM.

Maintaining Connectors, Connection Type and Configuration Parameters.

Maintaining EAM Parameters and ensuring that it is FF ID based.

EAM administration - Creating fire fighter IDs and assigning owner and controller to the fire-fighter ids.

Generated MSMP workflow and defined Business Rule Framework through BRF+, Mapped BRF+ application with MSMP workflow and defined request types for Process IDs. Imported Roles from the backend system to Front end system.

Execution and Simulation of risk analysis at user level and Role Level against Rule Set.

Maintaining Rule Set, Function ID & Risk ID with Risk Owners and Generating rules.

Creation and maintenance of Mitigation controls.

Configuration of Password Self Service.

Approving stalled request on behalf of role owners upon business requirement.

Generated MSMP Rule for Process, defined Business Rule Framework through BRF+, Mapped BRF+ application with MSMP workflow and defined request types for Process IDs

Deactivated unnecessary role types, configured length & naming convention.

Configuration of EAM and building the Reason Codes.

Running the risk analysis on Role Level & User level.

Creating users in GRC tool and assign roles as per the ticketing tool.

Performing Synchronization jobs related to Authorization, Repository Object, Action Usage and Role Usage Jobs in GRC AC 10.0

HANA STUDIO:

USER creation and role maintenance in HANA studio

Role creation in HANA according to the business requirements.

Executing monthly controls for AUDIT purpose.

FIORI:

Perform User Management, Role Management and assignment of catalogs, group in front end & catalog, assignment of T-Codes & ODATA services related to apps in SAP backend system using transaction PFCG.

Access has been provided to Fact sheets & Analytical apps in FIORI System.

For any missing authorizations & services analyzed and Identified through the transaction:

/N/IWFND/ERROR_LOG, /UI2/GW_ERR_LOG (Gateway error log) in Fiori front end system.

Based on client requirement created Front end/ backend roles; catalogs, groups & ODATA Services were added to the roles

CERTIFICATIONS:

SAP Certified Technology Associate – SAP System Security and Authorizations. Education

PGDM, Business Administration from YORK UNIVERSITY, Toronto Canada in 2021.

B.Tech, Electrical and Electronics Engineering from JNTU Hyderabad in 2016. SAP Professional Experience

INFOSYS LIMITED OCT 2021- TILL DATE

Client: Advanced Micro Devices.

Advanced Micro Devices, Inc. is an American multinational semiconductor company based in Santa Clara, California, that develops computer processors and related technologies for business and consumer markets. Role and Responsibilities:

USER creation and role maintenance in HANA studio

Role creation in HANA according to the business requirements.

Creating and working on CHANGE REQUESTS based on the business requirements.

Raising GRC request based on requirement and routing them to the path.

Creation or modifying Roles in Dev environment and assigning them to Test users for Functional teams to do testing.

Transporting Roles across development systems clients and to Quality and production systems.

Worked with security related tables such as AGR* & USR*.

Expertise in maintain different level of access like create/change/display to different org values like Plants and Company codes, sales organization. Etc., in same role.

Performed User & Role level risk analysis to find the exiting SOD violations for users.

Performed Remediation & Mitigation against various risk for users & roles.

Provisioning the roles through Access request management to users.

Providing the log reports to managers based on the requirement.

Creating Access control owners for FF ID owner/controller, Role/Risk owner, and Mitigation Monitors/approvals, etc

COGNIZANT TECHNOLOGIES July 2020-June 2021

Client: PepsiCo Inc.

PepsiCo, Inc. is an American multinational food, snack and beverage corporation headquartered in Harrison, New York, in the hamlet of Purchase. PepsiCo has interests in the manufacturing, marketing, and distribution of grain-based snack foods, beverages, and other products.

Role and Responsibilities:

USER creation and role maintenance in HANA studio

Role creation in HANA according to the business requirements.

Executing monthly controls for AUDIT purpose in HANA and in ECC.

Creating and working on CHANGE REQUESTS based on the business requirements.

Expired user activity in Production systems.

GRC approver validation in production systems.

BOTID creation in production and Non- Production system.

Access provisioning using MYIDM.

Providing additional access to FFID as per the user requirements.

Maintaining security policy in all the systems.

BOTID creation in all environments according to the business requirement.

Opening OSSID connection and maintaining credentials in SECURE area in SAP PORTAL. ECC (6.4) Activities:

Worked with profile generator (PFCG) in creating Single roles, composite roles and derived roles. Maintaining org values for the derived roles

Used several reports to support SAP R/3 security reporting needs.

Restricted the list of illegal passwords.

Extensively worked on trouble shooting the user authorization issues using SU53 and ST01.

Utilize SU24 to maintain authorization checks for various T-codes.

Protecting the Standard Users so that they are prevented from misusing.

Maintaining the critical users in Super User group.

Monitoring list of users who are having access to powerful profiles like SAP_ALL and SAP_NEW etc. and alerting the client on the same.

Periodically executed reports (RSUSR*) to detect security checks. CAPGEMINI INDIA April 2019 – April 2020

Client: Takeda Pharmaceutical

SAP MDG & Security consultant

Takeda is a research-based global company with its main focus on pharmaceuticals. As the largest pharmaceutical company in Japan and one of the global leaders of the industry, Takeda is committed to strive towards better health for patients worldwide through leading innovation in medicine. Takeda's ethical drugs are marketed in around 100 countries worldwide

Role and Responsibilities:

Was the part of GO Live for some countries.

Role creation and modification according to the business requirement.

Assigning and deletion of roles to the users according to the business requirement.

Changing the validity of the users using SAST tool.

Preparing the role assignment sheets according to the business requirement.

Solving the issue of the user using Service now ticketing tool. ECC 6.0 Activities

Resolving missing authorization issues by using SU53, ST01 and SUIM.

Worked on Authorization groups using SE54.

Authorization checks using transaction SU24 and maintained check indicators for T-codes.

Expertise in using Profile Generator (PFCG) for Creation of roles (Single, Composite, Derived).

Worked with AGR* tables.

Analyzing Missing Authorizations by using SU53 & ST01.

Experienced on Table Security by assigning authorization groups and maintaining Authorization object.

Maintaining check indicators for T-codes in SU24 as per the request. Client 2:

Medline Sept 2017 – April 2019

SAP Security & GRC Consultant

Medline is the largest privately held manufacturer and distributor of medical supplies uniquely positioned to provide products, education and support across the continuum of care. Our ability to bring best practices from one care setting to another — from large healthcare systems and independent physician practices to home health patients and their families, is what sets us apart.

Role and Responsibilities:

GRC AC 10.1 Activities

Implemented standard GRC AC 10.1 which includes

Configuration Settings after getting inputs from the customer

ARM Workflows: New Request, Change Request through MSMP & BRF+ workflow configuration.

EAM – ID Based.

ARA – Risk Analysis, Integration with ARM.

BRM – Multiple Role Import, Integration with ARM and ARA.

Configuration of Password Self Service and End User Login.

Creating Owners, Controllers and assigning them as Access Control Owners in the NWBC, Configured End User Personalization Forms and supported Global users with access request and approvals at various levels.

Checking the SOD through GRC-ARA and mitigating of users.

Worked with EAM, assignment of firefighter` ID’s to the users and changing the validity of ID request & generating log reports.

ECC 6.0 Activities

Resolving missing authorization issues by using SU53, ST01 and SUIM.

Worked on Authorization groups using SE54.

Authorization checks using transaction SU24 and maintained check indicators for T-codes. Client 1:

Merck Limited June 2016 – Aug 2017

SAP Security Consultant

Merck Limited (formerly E. Merck Limited) was set up in India as the first. Merck subsidiary in Asia in 1967. The Company operates both its Pharmaceuticals and Chemicals businesses in the country. Merck was also the first Merck Group Company to go the first Merck Group Company to go. Roles and Responsibilities:

SAP ECC 6.0 Activities:

Managed user parameters.

Worked with profile generator (PFCG) in creating Single roles, composite roles and derived roles. Maintaining org values for the derived roles

Used several reports to support SAP R/3 security reporting needs.

Restricted the list of illegal passwords.

Worked with security related tables such as AGR* & USR*.

Extensively worked on trouble shooting the user authorization issuesusingSU53 and ST01.

Utilize SU24 to maintain authorization checks for various T-codes.

Protecting the Standard Users so that they are prevented from misusing.

Maintaining the critical users in Super User group.

Monitoring list of users who are having access to powerful profiles like SAP_ALL and SAP_NEW etc. and alerting the client on the same.

Periodically executed reports (RSUSR*) to detect security checks.

Contact this candidate