Sonali Pargal

SAP Security & GRC Lead with 10 years securing complex, multi-system SAP landscapes (ECC, S/4HANA, Fiori, BTP, IAS/IPS, IAG, C4C, IBP, SAC, Ariba) supporting active users across multi-country rollouts in regulated, audit-intensive, GxP-validated environments. Acting as solution architect for global role redesign- authorization-concept design through go-live and steady-state governance, SoD remediation, and GRC tool implementations. Hands-on across the full Pathlock/Security Weaver GRC suite (ARM, ARA, BRM, EAM), owns Solution Manager authorizations and Charm access governance for GxP-compliant change management.

SME/Lead – SAP Security & Internal Control at Centrient Pharmaceuticals (2022-06 – Present)

Act as Solution Architect for SAP Security & GRC programs end-to-end — RFP response, technical design, build, go-live, and steady-state support — reporting risk posture directly to the IT Security Director.

• Cut SAP license costs 30% by leading a usage audit across the full multi-country user base and redesigning the license type allocation strategy.
• Cut access-provisioning time by 40% by implementing Security Weaver/Pathlock GRC (ARM, ARA, BRM, EAM, firefighter IDs) with automated SoD conflict analysis, mitigating controls and other workflows.
• Closed 95% of open audit findings within three months and drove ITGC remediation (change management, access reviews, segregation of duties) that delivered 100% compliance on the following external audit.
• Built the SoD ruleset in SAP Access Control from the ground up — risk definitions, function-level mapping, mitigating controls — and led role redesign/conflict remediation across ECC and S/4HANA.
• Designed S/4HANA Fiori security — business roles, catalogs, groups, spaces/pages, OData service activation and troubleshooting — and led ECC-to-S/4 role alignment for the migration.
• Own Solution Manager security administration, including authorizations for the Charm (Change Request Management) workflow — controlling who can raise, approve, and transport changes — keeping change management traceable and audit-ready under GxP requirements.
• Support GxP computer system validation for SAP: contribute to validation protocols (IQ/OQ/PQ) and ensure security & access controls — audit trails, segregation of duties, role-based access — meet GxP requirements for validated systems in a pharma manufacturing environment.
• Set up Central User Administration (CUA) and own security administration across ECC, C4C, IBP, SAC, and Solution Manager for a multi-country user base.
• Translated control-framework and business requirements into authorization concepts, functional/technical design specs, and emergency access provisioning processes.

Senior Specialist – SAP Security at The Chemours Company Pvt. Ltd. (2021-01 – 2022-06)

• Owned SAP security compliance and audit response within an Agile delivery model, from requirements gathering and design through approvals, build, and technical go-live.
• Designed and implemented Fiori catalogs/groups and S/4HANA business roles under SOX-aligned controls, reducing rework during audit cycles.
• Built and scheduled recurring audit security reports (user access reviews, SoD violation summaries) and partnered directly with client security managers to clear delivery blockers.
• Used GRC ARA and EAM to run continuous SoD conflict analysis and manage firefighter access, and got proposed SAP security best practices adopted as standard business controls.
• Supported SOX walkthroughs and ITGC testing for ERP-related controls, coordinating evidence collection with internal and external auditors.

Technical Delivery Specialist – SAP Security at Alstom Transport Pvt. Ltd. (2016-07 – 2021-01)

• Administered authorizations across Solution Manager, CUA, Fiori, and ECC for a multi-country transportation business.
• Hardened security baseline parameters (password policy, login controls, table logging) governing user access provisioning, reducing manual exceptions.
• Led periodic SAP user license audits (classification of Professional/Limited Professional/Employee users) and kept systems in continuous validated-compliance status.
• Ran GRC ARA and EAM for SoD conflict identification and emergency/firefighter access governance across the transportation landscape.
• Advised leadership on internal control/security risk decisions and administered emergency access for end users during cutover and support windows.

Bachelor of Technology in Electronics & Communication Engineering – National Institute of Technology (NIT), Srinagar, India (2012-05 – 2016-06)