Chandra Mutyalapati

SAP and CISA certified GRC and Security Consultant having over 15 years of experience in SAP Security and GRC, spanning across implementation and support projects. Specialized in IAG, GRC Access Control, Process control and Risk Management and SailPoint IIQ- implementation, upgrade, and maintenance. Extensive experience and knowledge in designing and developing roles and authorizations for S4/HANA, FIORI, BTP, ECC, SAC and BPC modules.

Experience in SAP UI Masking implementation and SAP license optimization. Strong knowledge on SOX SOD rules, GDPR and other audit compliance standards and ITCG controls.

Experience in setting up of SOX controls, maintenance, and monitoring.

Experience in working for Full Life Cycle Implementations, Go-Live, Post Go-Live, and Production Support projects.

Detail

Oriented, organized, customer focused individual, with strong professional integrity. Ability to establish and maintain high level customer trust and confidence, business relationships with excellent communication skills with both technical and business audience. Knowledge in developing SAP ABAP objects such as Reports, Forms, Scripts, BDC, LSMW, BADI, BAPI, ALE/Idocs, Webdynpro and workflows etc.

Senior Consultant – SAP Security and GRC - New York Power Authority - New York

(2025-11)

• Led the end-to-end design, development, and implementation of SAP ECC Security roles for a newly acquired business entity, managing the complete lifecycle from requirements analysis and role design through testing, deployment, and successful go-live.
• Represented the customer throughout the SAP S/4HANA, Fiori, SAC and SAP BTP transformation, facilitating design workshops, validating business requirements, and providing governance over the implementation partner's deliverables.
• Reviewed and validated business role concepts, authorization designs, and security architecture to ensure compliance with enterprise security standards and least-privilege principles.
• Partnered with business process owners to review and optimize the SAP GRC Segregation of Duties (SoD) ruleset, providing risk-based recommendations that balanced compliance objectives with operational efficiency.
• Reviewed functional and security test strategies developed by the implementation partner, identifying security gaps and recommending comprehensive negative and exception-based test scenarios to validate authorization controls and system resilience.
• Oversaw the SAP GRC Access Control implementation by reviewing solution architecture, validating functional and technical designs, monitoring implementation milestones, leading testing and user validation sessions, reviewing IT General Controls (ITGC), and ensuring alignment with governance and compliance objectives.
• Provided governance and strategic oversight for SAP BTP security architecture and implementation, reviewing security designs, identity and access management concepts, and authorization models while ensuring adherence to SAP security best practices and organizational standards.
• Reviewed and validated security-related test scenarios to ensure business processes were executed with appropriate authorizations while enforcing least-privilege access.
• Collaborated with business users, functional consultants, and the implementation partner to resolve authorization issues identified during integration testing and UAT.
• Collaborated closely with business stakeholders, IT leadership, and external implementation partners to resolve design challenges, manage project risks, and ensure timely delivery of secure, compliant, and business-aligned SAP solutions.

Lead – SAP Security and GRC - Motiva Enterprise - Houston, TX

(2025-01 - 2025-11)

• Analyzed S/4HANA solution design documents and designed, developed, and implemented SAP security roles supporting RTR, PTP, Supply Chain, and MDG business processes.
• Designed and configured SAP Fiori catalogs, spaces, and pages while managing role-based authorizations to ensure secure and seamless user access.
• Resolved SAP Fiori authorization issues by identifying missing OData services, activating required services, and updating security roles to restore application access.
• Configured and administered SAP Identity Access Governance (IAG) integration with SAP S/4HANA, enabling automated user provisioning and Segregation of Duties (SoD) risk analysis.
• Designed and maintained SAP IAG Business Roles by integrating S/4HANA security roles and SAP BTP role collections to support enterprise access governance.
• Implemented and integrated SAP Identity Access Governance (IAG) with SAP S/4HANA and SAP BTP, enabling real-time SoD risk analysis, Privileged Access Management (PAM), and automated access provisioning.
• Implemented and maintained SAP Build Work Zone roles and exposed SAP Fiori content to deliver a unified and role-based user experience.
• Designed and implemented SAP Process Control solutions for Continuous Control Monitoring (CCM) to automate compliance and control validation.
• Configured SAP Process Control data sources, business rules, and automated control schedules to support continuous monitoring of key business controls.
• Monitored Process Control exceptions, collaborated with control owners to resolve issues, and ensured timely remediation of compliance findings.
• Led the SAP Security team during User Acceptance Testing (UAT), mock cutovers, production cutover activities, and post-go-live hyper care support, ensuring successful project delivery.

Senior SAP GRC and Controls Specialist - Next-Decade Energy - Houston, TX

(2024-10 - 2024-12)

• Executed SOX control test plans, identified control deficiencies, and recommended remediation strategies to strengthen compliance and mitigate audit risks.
• Recommended business process and technical control improvements to align with SOX compliance objectives, regulatory requirements, and industry best practices.
• Reviewed and optimized SAP GRC Access Control rulesets by eliminating false positives and incorporating risks from the Risk Control Matrix (RCM) to improve Segregation of Duties (SoD) analysis accuracy.
• Extended and enhanced SAP GRC Access Control capabilities across multiple SAP landscapes, standardizing governance and access management processes.
• Implemented and administered SAP GRC User Access Review (UAR) functionality to automate periodic access certifications and strengthen compliance.
• Collaborated closely with internal and external auditors, business process owners, and control owners to provide audit evidence and support successful SOX control testing.
• Recommended process improvements for business controls, evidence collection, and remediation activities to improve audit readiness and facilitate timely closure of audit findings.
• Designed and implemented SAP BTP Security by integrating BTP subaccounts with SAP Identity Authentication Service (IAS) and Okta, creating role collections, mapping Okta user groups for automated user provisioning, and enabling secure, role-based access management.

SAP GRC Senior consultant - Protiviti - Houston, TX

(2024-06 - 2024-10)

• Led the upgrade of SAP GRC Access Control from version 10.1 to 12.0, ensuring a seamless migration with minimal business disruption.
• Extended SAP GRC Access Control to the new SAP landscape (Stripes), enabling centralized access governance and compliance management.
• Configured SAP GRC rulesets for the new SAP landscape, defined mitigation controls, and recommended remediation strategies to address Segregation of Duties (SoD) risks.
• Implemented SAP GRC Emergency Access Management (EAM) for the new SAP landscape, enabling secure firefighter access and compliant privileged access management.
• Configured MSMP workflows for access requests, firefighter log reviews, and workflow customizations to streamline access governance and approval processes.
• Implemented SAP GRC User Access Review (UAR) workflows and established governance processes for periodic user access certifications and compliance reviews.
• Supported SOX audit activities by overseeing control testing

Consultant – SAP GRC and Security - Energy Transfer LLC

(2022-05 - 2024-06)

Senior SAP Consultant - Ashland LLC

(2015-07 - 2022-04)

Associate Consultant - Infosys Ltd.

(2013-02 - 2015-06)

SAP Consultant - CSC India Pvt. Ltd

(2010-07 - 2013-02)