CISSP and CISA Certified SAP Security and GRC Expert

Melbourne (Australia)
* Managed exposure to Information Security risk through the development and maintenance of
information security standards, policies, processes, and solutions, ensuring their effective
implementation across the organization.
* Led cybersecurity efforts on multiple digital business transformations involving SAP S/4
HANA greenfield implementation. Efforts included the development of security strategy,
security controls, governance, compliance, and operating models through these transformation
programs.
* Led SAP Governance, Risk, and Compliance (GRC) Access Control and Process Control
implementations for clients from various industries, collaborating with key stakeholders to
understand requirements and risks, translating requirements into project scope, performing
system configuration and maintenance, executing system testing, supporting project cutover
and hyper care activities, providing knowledge transfer and training to junior team members.
* Managed cybersecurity & controls efforts for a $250M+ government program that transitioned
50+ state agencies from outdated business processes and antiquated technology to a single,
modern ERP solution (SAP). Deliveries included:
* Development of security solution architecture based on ISO 27000, NIST, and PCI-DSS
framework.
* Deployment of application access profiles/roles & roll out to the State agencies for
their financial system.
* Implementation of SAP Governance, Risk, and Compliance (GRC) Access Control and Process
Control
* Leading access risk remediation and mitigation efforts for State agencies. Collaborated
with security and functional teams in the development of 40+ mitigation controls for
identified segregation of duties risks; trained and supported 100+ agency personnel
designated to use GRC; contributed advice and guidance on security strategies to manage
identified risks and ensure adoption and adherence to standards.
* Leading vulnerability scanning & remediation of cyber risk in the infrastructure.
* Development of Internal Controls and IT General Computer Controls mapping to NIST 800-53
rev 4.
* Providing assurance over the completeness, accuracy, and quality of key risks and
controls documented in the Enterprise Risk Management System.
* Implementation of SAP HANA Analytics
* Implementation of SAP Business Integrity Screening and SAP Analytics Cloud for financial
reporting.
* Upgrade of SAP GRC from version 10.1 to version 12.0.
* Integration of GRC with SuccessFactors for automated access provisioning and risk
analysis.
* Development of policies and procedures
* Coordination with internal/external auditors on all audit requirements.
* Conducted Risk assessments, Privacy Impact Assessments, and Internal Control testing across
Technology teams.
* Designed and implemented data protection and data privacy tools (UI masking) for protection.
* Developed cyber security policies and procedures.
* Management of day-to-day operation of IT Security in accordance with IT Security and Risk
Governance Frameworks and Management standards, including incident response.
* Program management of end-to-end enterprise security design jointly with the client
stakeholders; oversaw the SDLC for multiple business divisions in a staggered go-live
implementation over an extended period; proactively managed issues and risks for the entire
program.
* Oversight responsibility for 20+ consultants providing design, implementation, change
management, and PMO services; ensured implementation of Statement of Work and Performance
Specifications in accordance with contract directives.
* Developed intelligent risk sensing solutions using SAP Business Integrity Screening (BIS)
leveraging AI and machine learning capabilities for predictive analysis of business
anomalies.
* Led implementation of a cloud-based analytics platform for financial reporting including
business intelligence, planning, and predictive capabilities.
* Prepared the Statement of Work for newly proposed projects.
* Participated in business development efforts by way of assisting in technical proposal and
effort estimation creation.
* Led strategic initiatives in Deloitte's risk advisory practice, such as driving go-to-market
efforts for risk analytics, BIS, and GRC

* Conducted internal audits and reported on quarterly audits of entity-wide and business
process controls as approved by the Audit Committee
* Worked with internal audit, application owners, and technical SMEs to understand the
enterprise risk and control environment, perform gap analysis, and articulate control
deficiencies and remediation techniques to client senior management.
* Assessment of the likelihood and impact of identified risks using both qualitative and
quantitative methods and development and implementation of risk mitigation strategies/action
plans to reduce the organization's exposure to identified risks.
* Conducted audit sessions to gather & review document samples and prepare work papers to
evaluate design effectiveness & operative effectiveness of the business and IT control.
* Assessed the design and implementation of SAP security, SAP GRC, SAP BASIS, SOLMAN, change
management, Application security, and Interface controls to help clients comply with
Sarbanes-Oxley 404.

(India), New Jersey (USA)
* Worked on global implementation programs of SAP ECC application security, GRC, and controls.
As part of these programs, responsibilities included executing tasks against an integrated
project plan, addressing project risks and issues, directing cutover activities, and
coordinating post-go-live support management.
* Led SOX compliance efforts relating to access management, change management, and periodic
review of user access.
* Analysis of information management processes to identify security exposure and propose
solutions.