SAP Security Consultant - GDC

Job Title: SAP Security Consultant - GDC Company: Lemongrass Consulting Job Category: SAP ABAP Roles & Responsibilities: Job Details and Responsibilities This is a consultant run-and-operate role within an SAP Security managed services team, not a project delivery role. You will support clients across the UK and EU time zone, handling complex security incidents and service requests, collaborating with senior colleagues on escalations, and helping clients restore secure, reliable service. You will spend most of your time inside live client landscapes: resolving authorisation incidents, assessing and implementing security changes with appropriate attention to production risk, and contributing to sound, sustainable security design. You will also participate in client service reviews and support responses to audit questions. * Handling SAP Security incidents and service requests across a portfolio of managed services clients, escalating appropriately when specialist input is required * Resolving complex authorisation failures through trace analysis (STAUTHTRACE, SU53, SUIM), working with senior colleagues where issues require deeper investigation * Assessing, designing and implementing role changes raised as change requests, including impact analysis against live user populations * Contributing to problem management for recurring security issues — supporting root cause analysis, implementing permanent fixes, and updating runbooks; the ability to work independently and seek guidance when needed is essential * Working to defined SLAs for response and resolution, with accurate ticket hygiene in ServiceNow or equivalent * Administering SAP BTP security in a BAU context — Identity Authentication Service (IAS), Identity Provisioning Service (IPS), XSUAA, role collections, and subaccount entitlement management across client subaccounts * Running and reviewing SAP GRC Access Control processes: Access Request Management, Emergency Access Management firefighter log review, Access Risk Analysis * Supporting periodic user access recertification campaigns end to end * Monitoring and remediating SoD conflicts as business-as-usual, not as a one-off exercise * Reviewing and applying security-relevant SAP notes and advising clients on patching priority * Participating in monthly client service reviews, contributing trend analysis and practical improvement recommendations * Producing audit evidence and supporting responses to internal and external auditor queries * Explaining risk, design trade-offs and remediation options clearly to technical and non-technical client stakeholders * Contributing to continual service improvement: automation, runbook quality, and reducing repeat ticket volume * Supporting less experienced consultants and participating in peer reviews of role changes before production * Writing and maintaining knowledge articles and runbooks * Demonstrable, current SAP BTP security experience — specifically IAS, IPS and XSUAA / role collection design and administration. In your application, describe clearly what you have implemented or supported. * Minimum 7 years in SAP Security and Authorisations * Managed services or application support experience — you have worked to SLAs, in ticket queues and on live production systems, and understand how this discipline differs from project work * Strong S/4HANA and ECC role-design experience, including derived roles, composite roles and organisational level management * Strong Fiori authorisation experience end to end — catalogues, groups, spaces and pages, and the tile-to-authorisation chain * Hands-on SAP GRC Access Control * Experience of SoD analysis, remediation and ongoing monitoring, with exposure to audit support * Able to manage work across multiple client accounts, working independently while escalating risks and complex issues appropriately * Professional working proficiency in English * Hours of work: UK and EU Business hours, with participation in a shift and on-call rota Our work spans SAP Cloud migrations, managed services, SAP Business Technology Platform (BTP), Business Data Cloud (BDC), and AI-enabled solutions. We help customers build clean core strategies, intelligent data foundations, and scalable Cloud operations across AWS, Microsoft Azure, Google Cloud Platform, and SAP Cloud ERP. Work Location: India Availability: Full time

Qualifications Essential Experience : * ITIL foundation or equivalent service management grounding * SAP Identity Management (IdM) or a third-party IGA tool (SailPoint, Saviynt) * Cloud Identity Access Governance (IAG) * HANA database security and analytic privileges * SuccessFactors, Ariba or Concur security models * Read-only ABAP debugging for authorisation troubleshooting * Regulated industry exposure — pharmaceutical, financial services, energy * Scripting or automation experience applied to security operations * Relevant SAP certifications This position may require domestic and international travel as needed to meet business and client requirements.* Key Skills: Debugging Salary: Not disclosed