SAP GRC demand

[Former Member]

Hi everyone,

does SAP GRC/Security has enough scope compared to SAP BASIS ?

Both in terms of Onsite oppurtunities and demand ?

regards

Rakesh

[Former Member · Accepted solution]

Enough? That's hard to say.

Every SAP system, whether GRC or anything else, requires Basis input. Pretty much by definition, then, theree's more Basis-level work than GRC work. As Gretchen said, there are complications from on-premise/cloud/outsourcing arrangements, but still I'd be surprised if there wasn't a lot more Basis work overall.

If you are talking about GRC rather than simply ERP security, I'd say the skill sets are quite different. I've done both, but I don't know many others who have. GRC requires much more of a functional and audit mindset.

Steve.

[Former Member]

Rakesh,

That is an impossible question to answer, for several reasons.

1. Most of us have never been Basis professionals and would have no logical point of comparison.

2. In my observation, no two SAP shops are exactly the same. Some customers have Basis support done in house by employees, some have it outsourced, and some do a combination. Some support teams and project teams are very lean, others less so. Some shops buy every solution SAP has to sell, others have a mix of SAP and non SAP solutions in their landscape.

3. My guess is that there are plenty of GRC10 opportunities for skilled professionals with suitable training and experience, particularly experience in security design, workflow, and controls. Freshers without any such experience would be in less demand.

4. Some SAP shops keep their Basis people constantly busy with upgrades and support packs, others less so. Likewise, some GRC support teams stay busy with support packs, updates to their ruleset, configuring and implementing new GRC functionality, and others do not have the funding for such projects all the time. Likewise, some consultancies such as PwC which are global GRC partners, do quite a bit of GRC work. You would have to ask an independent consultant how busy they are with GRC work these days; my guess is that many of them do some security work in between GRC projects, so it would be helpful to have both skillsets.

Gretchen