search Browse Jobs
SAP GRC and HANA Security ConsultantKyndryl · Singapore, Singapore
Kyndryl logo

Kyndryl

company page ↗ Visa Sponsoring Company

SAP GRC and HANA Security Consultant

✓ This company has sponsored visas before. The posting doesn't say so, but it's still worth applying.

🗓️ Posted 2026-08-24 Singapore, Singapore Full-time Hybrid ICT
💰 Salary Not shared 📊 Market S$6,000–S$10,000/mo

About the Company

At Kyndryl, we run and reimagine the mission-critical technology systems that drive advantage for the world's leading businesses. We are at the heart of progress; with proven expertise and a continuous flow of AI-powered insight, enabling smarter decisions, faster innovation, and a lasting competitive edge. For our people-Kyndryls-that means doing purposeful work that powers human progress. Join us and experience a flexible, supportive environment where your well-being is prioritized and your potential can thrive.

About the Role

We are looking for an SAP GRC and HANA Security Consultant to design, implement, and govern access controls across our SAP landscape. This role sits at the intersection of technical security administration and compliance: you will build and maintain role architecture across S/4HANA, HANA database, and Fiori, run our GRC Access Control platform end to end, and act as the primary technical contact for internal and external auditors on SAP access matters. This is a hands-on position for someone who is equally comfortable writing an analytic privilege in HANA Studio, remediating a segregation-of-duties conflict in ARA, and explaining both to a non-technical control owner.

Responsibilities

  • ● Configure, administer, and support SAP GRC Access Control 10.1/12.0 across all four modules: Access Risk Analysis (ARA), Access Request Management (ARM), Business Role Management (BRM), and Emergency Access Management (EAM/Firefighter).
  • ● Maintain and customize the SoD ruleset - add custom risks, functions, and organizational rules; apply SAP-delivered ruleset updates and assess landscape impact.
  • ● Design and maintain MSMP workflows, BRF+ rules, and approval paths for access requests and role change management.
  • ● Perform periodic risk analysis at user, role, and profile level; drive remediation and design compensating/mitigating controls with business process owners.
  • ● Administer User Access Reviews (UAR), SoD Review, and Firefighter log reviews; track completion and escalate exceptions.
  • ● Support GRC Process Control, Risk Management, and Audit Management where in scope, and evaluate migration to SAP Cloud Identity Access Governance (IAG).
  • ● Administer HANA database security: catalog and repository roles, users, system/object/analytic/package/application privileges, and privilege inheritance design.
  • ● Implement row- and column-level security through analytic privileges, and configure static and dynamic data masking for sensitive data.
  • ● Manage HDI container security and XS Advanced (XSA) roles, role collections, and OAuth/UAA configuration.
  • ● Configure and monitor HANA audit policies; produce audit trails for privileged activity and support forensic review.
  • ● Manage encryption (data volume, redo log, backup), certificate management, and TLS/SSL configuration.
  • ● Set up and support SSO and authentication methods including SAML 2.0, Kerberos, and X.509 certificates.
  • ● Administer security through HANA Cockpit and HANA Cloud Central, including HANA Cloud tenant security where applicable.
  • ● Design, build, and maintain PFCG roles for S/4HANA, ECC, BW/4HANA, and Solution Manager using SU24, SUIM, and authorization trace analysis (STAUTHTRACE/ST01).
  • ● Build and maintain Fiori security: catalogs, groups, spaces and pages, tile-to-role mapping, and front-end/back-end role pairing.
  • ● Support security for connected platforms - SAP BTP, SuccessFactors, Ariba, SAC, and CUA-managed systems.
  • ● Lead security workstreams for S/4HANA implementations, upgrades, and greenfield/brownfield conversions, including role redesign and remediation of legacy authorization concepts.
  • ● Troubleshoot authorization failures and performance issues, and provide L3 support for security incidents.
  • ● Serve as SAP security subject matter expert for SOX ITGC, internal audit, and external audit walkthroughs; prepare evidence and respond to audit requests and findings.
  • ● Enforce and improve access governance policy, including provisioning, deprovisioning, privileged access, and emergency access procedures.
  • ● Support data privacy requirements (GDPR and equivalent) as they apply to SAP access and data exposure.
  • ● Produce documentation: role design specifications, security concepts, runbooks, and control narratives.
  • ● Work with Basis, functional, development, and infrastructure teams on cross-functional design decisions.
  • ● Partner with business process owners to translate compliance requirements into workable role and control design.
  • ● Mentor junior security analysts and contribute to team standards and knowledge base.

Requirements

  • ● Bachelor's degree in Computer Science, Information Systems, or a related field, or equivalent practical experience.
  • ● 5+ years of hands-on SAP security experience, including at least 3 years with SAP GRC Access Control 10.x or 12.0.
  • ● Demonstrated hands-on experience with SAP HANA security administration - roles, privileges, analytic privileges, and audit policies - not solely at the application layer.
  • ● Strong working knowledge of PFCG role design, authorization objects, SU24 maintenance, and trace-based troubleshooting.
  • ● Experience with S/4HANA and Fiori security concepts, including catalog and space/page design.
  • ● Practical experience supporting SOX ITGC or equivalent audit and compliance requirements in an SAP environment.
  • ● Proven ability to analyze and remediate segregation-of-duties conflicts and design mitigating controls.
  • ● Clear written and verbal communication, with the ability to explain technical access risk to business and audit stakeholders.
  • ● Experience with SAP Cloud Identity Access Governance (IAG) or migration from GRC AC to IAG.
  • ● Experience with SAP Identity Management (IDM), SAP Cloud Identity Services (IAS/IPS), or third-party IGA tools such as SailPoint or Saviynt.
  • ● Exposure to SAP BTP security, including role collections, trust configuration, and destination security.
  • ● Experience with HANA Cloud, HDI, and XSA-based development security.
  • ● Full lifecycle S/4HANA implementation or conversion experience in a security lead capacity.
  • ● Scripting or automation experience (ABAP, Python, PowerShell) for reporting and provisioning tasks.
  • ● Certifications such as SAP Certified Application Associate - GRC Access Control 12.0, SAP Certified Technology Associate - SAP HANA, CISA, CISSP, or CRISC.