SAP Security/GRC Administrator

Stack

Responsibilities

• ▹Design, build, and maintain SAP roles (PFCG) using task- or job-based methodologies
• ▹Manage S/4HANA and Fiori security, including catalogs, groups, and OData authorizations
• ▹Oversee user provisioning, de-provisioning, and periodic access reviews
• ▹Manage security for SAP BTP and cloud solutions like SuccessFactors and Ariba
• ▹Configure and maintain GRC modules: ARA, ARM, EAM, BRM
• ▹Identify and remediate SoD and critical action violations with business process owners
• ▹Maintain and update the GRC Global Rule Set
• ▹Act as lead technical contact for internal and external audits
• ▹Perform regular system audits and security health checks
• ▹Monitor and apply SAP Security Notes with the Basis team

Requirements

• ▹Expert knowledge of FDA 21 CFR Part 11, EU Annex 11, and GAMP 5 guidelines
• ▹7+ years in CSV, including 2+ years in a leadership/coordination role in a regulated industry
• ▹Experience validating platforms such as SAP S/4HANA, LIMS, QMS (TrackWise/Veeva), MES, or clinical trial systems
• ▹Understanding of validating SaaS/cloud solutions and the shared responsibility model
• ▹Strong attention to documentation quality and audit-ready evidence
• ▹Ability to apply ICH Q9 risk-management principles
• ▹Ability to negotiate between IT and QA priorities
• ▹5+ years hands-on experience in SAP Security and GRC
• ▹Deep knowledge of S/4HANA security and SAP GRC 12.0
• ▹Experience with HANA DB user management and analytical privileges
• ▹Ability to trace complex authorization errors (SU53, ST01)
• ▹High degree of discretion given access to sensitive data and privileged credentials

Nice to have

• ▹SAP Certified Technology Associate – SAP System Security and Authorizations
• ▹SAP Certified Application Associate – SAP GRC Access Control
• ▹CISA certification

Soft skills

About the company

DXC Technology (NYSE: DXC) helps global companies run mission-critical systems while modernizing IT, optimizing data architectures, and ensuring security and scalability across public, private, and hybrid clouds.