SAP Security Consultant - GDC

Job Title: SAP Security Consultant - GDC Company: Lemongrass Consulting Job Category: SAP ABAP Roles & Responsibilities: Job Details and Responsibilities This is a consultant run-and-operate role within an SAP Security managed services team, not a project delivery role. You will provide experienced security support across client landscapes, taking ownership of incidents and service requests within your capability and collaborating with senior colleagues on the most complex or high-risk issues. You will spend most of your time inside live client landscapes: resolving authorisation incidents, assessing and implementing security changes against production risk, and supporting sound design decisions rather than short-term fixes. You will also contribute to client service reviews and help prepare responses to audit questions. * Handling SAP Security incidents and service requests across a portfolio of managed services clients, escalating the most complex or high-risk issues appropriately. * Resolving complex authorisation failures through trace analysis (STAUTHTRACE, SU53, SUIM), with support from senior colleagues where needed . * Assessing, designing and implementing role changes raised as change requests, including impact analysis against live user populations . * Contributing to problem management for recurring security issues — supporting root cause analysis, permanent fixes and improvements to runbooks; the ability to work independently within agreed processes is essential . * Working to defined SLAs for response and resolution, with accurate ticket hygiene in ServiceNow or equivalent . * Administering SAP BTP security in a BAU context — Identity Authentication Service (IAS), Identity Provisioning Service (IPS), XSUAA, role collections, and subaccount entitlement management across client subaccounts . * Running and reviewing SAP GRC Access Control processes: Access Request Management, Emergency Access Management firefighter log review, Access Risk Analysis . * Supporting periodic user access recertification campaigns end to end . * Monitoring and remediating SoD conflicts as business-as-usual, not as a one-off exercise . * Reviewing and applying security-relevant SAP notes and advising clients on patching priority . * Contributing security updates, trend analysis and improvement recommendations to monthly client service reviews . * Preparing audit evidence and supporting responses to internal and external auditor queries . * Explaining risk, design trade-offs and remediation options clearly to technical and non-technical client stakeholders . * Contributing to continual service improvement: automation, runbook quality, and reducing repeat ticket volume . * Supporting less experienced consultants and participating in peer reviews of role changes before production . * Writing and maintaining knowledge articles and runbooks, and sharing knowledge across the team. * Minimum 7 years in SAP Security and Authorisations . * Relevant managed services or application support experience — you have worked to SLAs, in ticket queues and on live production systems, and understand how this discipline differs from project work . * Strong S/4HANA and ECC role-design experience, including derived roles, composite roles and organisational-level management . * Good Fiori authorisation experience end to end — catalogues, groups, spaces and pages, and the tile-to-authorisation chain . * Hands-on experience with SAP GRC Access Control . * Experience of SoD analysis, remediation and ongoing monitoring, with exposure to audit requirements . * Able to manage work across multiple client accounts, working independently within agreed processes and seeking guidance when appropriate . * Based in India or the Philippines with the right to work in the relevant location . * Professional working proficiency in English. * Hours worked: UK and EU business hours, with participation in a shift and on-call rota. * ITIL foundation or equivalent service management grounding . * Current SAP BTP security experience — particularly IAS, IPS and XSUAA or role collection design and administration. Please describe what you have built or supported in your application. * SAP Identity Management (IdM) or a third-party IGA tool (SailPoint, Saviynt) . * Cloud Identity Access Governance (IAG) . * HANA database security and analytic privileges . * SuccessFactors, Ariba or Concur security models . * Read-only ABAP debugging for authorisation troubleshooting . * Regulated industry exposure — pharmaceutical, financial services, energy . * Scripting or automation experience applied to security operations . * Relevant SAP certifications. Our work spans SAP Cloud migrations, managed services, SAP Business Technology Platform (BTP), Business Data Cloud (BDC), and AI-enabled solutions. We help customers build clean core strategies, intelligent data foundations, and scalable Cloud operations across AWS, Microsoft Azure, Google Cloud Platform, and SAP Cloud ERP. Work Location: India Availability: Full time

Qualifications Essential Experience : This position may require domestic and international travel as needed to meet business and client requirements.* Key Skills: Debugging Salary: Not disclosed