Syed Afsarullah, Cisa Email & Phone Number

Wisconsin, United States

Chicago, Illinois, United States

• Maintain Risk and Control Matrix (RACM), Maintain documentation on SharePoint
• Perform GAAP Analysis and risk assessment
• Quarterly ITGC Controls review for SAP Basis & Security
• Perform periodic access review (PAR) for in scope IT applications
• Running Reports in SAP for critical Access, action usages report for Business T-codes
• Perform User Access review, follow up with teams for all required controls documents

Chicago, Illinois, United States

• Responsible for security of SAP R/3 all modules for production support
• Created and modified single roles, composite roles, derived roles for modules
• Take care of day-to-day Remedy Tickets, SNOW tickets.
• User provisioning, Access Modification, Authorization issues
• Troubleshoot authorization issues, role fixups
• Working closely with the compliance team for any SOD related issues.

Greater Chicago Area

• Part of the Program Assurance team within ITGRC Team
• Main contact person from ITGRC on two major Projects
• Facilitating project teams with compliance requirement pre-go-live and post-go-live
• Gathering documents, evidence of testing, BPD and PRD’s.
• Assisting SOX, HIPAA, GDPR teams with Manual and automated controls testing
• Quarterly ITGC Controls review for SAP S/4 HANA, Basis & Security

Greater Pittsburgh Area

• Responsible for overall Approva Upgrade Project from 6.1 to 10.1.0
• Gathered business requirements, blueprints, and proposed project plan
• Key member in driving the project forward to produce desired results as per deadlines
• Planned resources and formulate strategies as per project plan requirements
• Obtained business approvals, and built IQ, PQ’s and OQ’S
• Created test schedules, dry runs, and scripts

Miami/Fort Lauderdale Area

• Part of a merger of two large companies (Burger King and Tim Hortons)
• Involved in hiring resources specialized in SAP Security and Basis
• Part of IDM implementation and support on SSO for all SAP accounts.
• Created and modified single roles, composite roles, derived roles for modules
• Performed troubleshooting on R/3 Security problems by using system traces.
• Supported system integration testing and user acceptance testing

Toronto, Canada Area

• Part of a merger of two large companies (Burger King and Tim Hortons)
• Involved in hiring resources specialized in SAP Security and Basis
• Part of IDM implementation and support on SSO for all SAP accounts.
• Created and modified single roles, composite roles, derived roles for modules
• Performed troubleshooting on R/3 Security problems by using system traces.
• Supported system integration testing and user acceptance testing

Greater Minneapolis-St. Paul Area

• Responsible for security of SAP R/3 production support
• Part of Role Redesigning Project
• Worked on GRC 10.0 Access Control’s, Access Risk Analysis (ARA), Emergency Access Management, Access Request Management (ARM), and Business Role Management (BRM)
• Responsible for creating FF ids, processing ARM user requests in GRC 10.0 Access Control
• Mitigating users, running consolidated log report for FF users, user simulations
• Maintained/Monitored FireFighter access usage, non personal accounts, system security parameters, Interfaces, Inactive Accounts, system default users and termination for SOX Audit/IT Compliance

Allentown, Pennsylvania Area

• Worked with the finance department and SAP security team on SOX related issues
• Maintained and updated rule conditions
• Part of full annual review of rulebooks & rules
• Worked closely with rulebook owners on annual excluded user review
• Opened new cases with Approva team for any performance-related issues
• First level approval for assigning mitigating controls approved by RBO’s

Chicago, IL

• Actively involved in designing Rule Architect, mitigating controls
• Creating composite roles and derived roles using parent child concept
• Analyze all customer programs and transaction codes for authority checks
• Worked on SAP check Indicator defaults, field values, and maintained check indicators for transaction codes using (SU24)
• Using system trace to record authorization checks in different sessions
• Perform role and user level SOD analysis for sensitive access