Security & GRC · TIB-PATH-SEC-LEAD

Security Lead Path

Govern the SAP Security and GRC workstream and own the access architecture.

Request Course InformationCompare Pathways
22Stages
222Guided steps
~280 (~165 with placement)Practice hours
Academy and Lead defenceCapstones
Who it is for

Experienced SAP security Seniors and SAP project managers moving into the Security and GRC Lead seat.

Your target role

A GRC and Security Lead able to govern the workstream, own access architecture and lead incidents, audits and transformation projects.

Official brochure structure

Course stages

Live, instructor-led teaching, guided SAP labs and app-based practice in the sequence of the job.

01   Stages 1–13: complete Security Senior core (148 steps)
02   14. Security governance and stakeholder management
03   15. Access architecture, IAM/IGA, SailPoint and cloud identity
04   16. Thornfield Security Lead deep-dive books
05   17. Lead labs: privileged access, leavers, GRC, custom code and indirect access
06   18. Thornfield Team Chapters 6, 7, 9 and 11: Lead decisions
07   19. Enterprise Projects 2 and 3: S/4HANA transformation and hybrid cloud
08   20. Team Chapters 13–15: reporting and handover
09   21. Corvane Academy: PM to GRC and Security Lead
10   22. Architecture, leadership and interview defence
Important curriculum clarification

Why a security course starts with control basics

Security work is control work. An SoD conflict is a risk, a mitigating control is a control, and an access review is a detective control. GRC Access Control assumes you already know what preventive, detective and mitigating mean.

Daily security work

Understand the risks behind access

Role design, access requests, segregation of duties, emergency access and access reviews all involve risk and controls. Control basics explain why access decisions matter, not only how to configure them.

Audits and exams

Explain security evidence

SOX, ITGC and audit support (Stage 9) and the Security Final Exam's SOX/ITGC section rely on this vocabulary. Security consultants must be able to explain access and change evidence to auditors.

Professional readiness

Speak the language of the job

Interviewers ask SAP Security and GRC consultants about controls because many SAP security roles sit within SOX programmes. This foundation helps you work effectively with audit and compliance teams.

Why this is not a Controls specialist course: The Security pathway teaches the control concepts necessary to design, operate, review and defend SAP security and access. The separate Controls & Compliance pathway teaches specialist controls scoping, testing methodology, evidence evaluation, deficiency reporting and controls leadership.

Security Senior: control foundations begin in Stage 1, underpin GRC Access Control in Stage 5, and support SOX/ITGC audit work in Stage 9. Security Lead: the complete Senior core is included in Stages 1–13 before the advanced Lead stages.

Compare Controls Senior · Compare Controls Lead

Proven, not just attended

Assessment and progression

70% for each team chapter and Academy component; 21/30 on Academy Security Capstone presentation; graded Lead defence. Experienced Seniors may take the 45-question Security Final Exam for placement into Stage 14.

Training combines practitioner-led live classes, TIB-hosted SAP/GRC labs, the TIB SAP Training Assistant, Thornfield scenarios and relevant Corvane or Enterprise Project work. Existing Academy application access is not changed by this website update.

Related course: Security Senior core

Fees and next confirmed cohort dates: contact TIB for current information.

Request Course Information