SAP Security/GRC Expert - Access Control (Contract SME)

M&S (which stands for Management and Solutions) was conceived in 2002 with the vision of creating highly effective teams of elite consultants to deliver strategic process and technology solutions to enterprise organizations across the US. Our commitment to delivery in complex environments and long-term customer success has merged process and technology into innovative solutions, established deep pockets of expertise, and enabled innovative transformation for evolving businesses.

We have intentionally cultivated steady growth focused on being approachable and helpful to our dearly valued clients and closely cared-for employees. M&S people simply “care hard”, and this reflects in our work products, our interactions, and our culture.

Overview:

M&S Consulting is seeking a senior SAP Security and GRC Subject Matter Expert to support a post go-live stabilization effort. The engagement focuses on cleaning up the Access Control landscape, remediating broken or misconfigured workflows and validating Segregation of Duties (SoD) controls against issues already identified by the internal team. The SME will work shoulder to shoulder with an internal resource and transfer knowledge throughout the engagement so the organization can own ongoing maintenance.

Key Responsibilities:

• Perform post go-live cleanup of the SAP GRC Access Control environment

• Diagnose and remediate broken or misconfigured workflows, including cross-organizational approval flows

• Validate and remediate SoD issues surfaced during internal review; document mitigating controls where remediation is not feasible

• Review and refine role design, user provisioning and access request workflows

• Provide direct, hands-on knowledge transfer to the assigned internal resource across every workstream

• Document remediation activities, design decisions and residual risks for clean handoff

• Surface additional scope discovered during remediation for joint decisioning at the mid-engagement checkpoint

Required Qualifications:

*US Citizenship required

• Ability to work core hours in US Eastern Time

• Senior-level practitioner: 10+ years of SAP Security experience with deep focus on GRC Access Control (10.x or 12.x)

• Hands-on expertise across the GRC AC modules: Access Request Management (ARM), Business Role Management (BRM), Emergency Access Management (EAM/Firefighter) and Access Risk Analysis (ARA)

• Demonstrated experience remediating SoD conflicts and defining mitigating controls

• Strong SAP role design background (single, composite, derived) and user provisioning

• Experience troubleshooting MSMP workflows and BRF+ rules

• Comfort operating in a post go-live stabilization context where scope surfaces iteratively

• Strong written documentation and knowledge-transfer skills; able to teach as much as they deliver

• Track record operating effectively in a fully remote engagement model

• Eastern time working hours strongly preferred

Preferred Qualifications:

• Experience with SAP S/4HANA environments

• Experience as an embedded SME rather than a large-program contributor

• Familiarity with cross-entity or shared-services access scenarios

Success Criteria:

• Access Control environment cleaned up and documented

• Identified SoD issues remediated or formally mitigated

• Workflows functioning end to end

• Internal resource meaningfully upskilled and able to sustain the environment post-engagement

*M&S Consulting proactively fulfills its role as an equal opportunity employer. We do not discriminate against any employee or applicant for employment because of race, color, sex, religion, age, sexual orientation, gender identity and expression, national origin, marital status, physical or mental disability, status as a protected veteran, or any other characteristic protected by law.