Hi Scotty,
As you have said , you have done user creations, SOD from security and RFC creation,System refreshes and upgrade from BASIS it looks like you have a hands on from both areas Security and BASIS however I would say it is only mere beginning of each modules.
for BASIS:
Currently the skillset with just SAP BASIS is not sufficient in the market. Customers need SAP BASIS with HANA administration too. Besides the Hot technology HANA, for BASIS DB administration is also a key skillset to capitalize better opportunities in the market.
you have not explained what kind of upgrade have you performed and the tools you have used however every upgrade is unique ;version upgrades, EHP upgrade, support pack upgrades though the underlying framework is same the tools used to perform these upgrades are evolving.
Transport management is a start up activity for any BASIS guy while
key enthusiasm for a person to excel in BASIS would be constant technical knowledge update , troubleshooting patience and understanding the importance of sacrificing social hours to keep customer happy.
The growth area in BASIS would be, as you learn SAP solutions ( SAP product administration), you need to get expertise with Databases ( HANA, Sybase, Oracle,SQL, DB2), good knowledge of OS administration ( Unix, Linux, AiX and Windows) and a glimpse of Networking
Having said this as grow this would be the areas of your exposure and you have to brand yourself as technical person thought out career.
For Security:
In above mentioned options ,outside user creation and SOD, like SSO setup and Certificate based authentication is still involved with BASIS activities hence it is not the scope for complete security consultant.
As you learn SOD, you need start learning business process you would excel in security area.
So as a security person you will have an opportunity to understand the business process and gives you an understanding of real world like scenarios and business hierarchies which is for kind of person who likes to be in tact with business terminology and market happenings.
With BASIS you would know about SAP products but not about the modules ( functionalities of the product) and not about the business logic
With Security you would know about business process and also little bit about SAP product ( as you know which module runs on which SAP product.
Being a BASIS guy you remain as a technical consultant more like a backend person
Being a security guy your role is major in front of the customers and take key decisions in securing data.
Years down the line, as you grow in an organization being a BASIS guy, you may have to stick to technical department .However if you are a security guy, you can take up quality / compliance roles to secure the company data and move away from technical department if you like to. The business process learned during the security work helps and also the security certifications gives add on value. with those compliance courses you can take up advisory positions in organizations focused with services.
Thanks,
Sai