Is there a log for when a user has elevated their privileges to security_admin?
Release or Environment
When a user has elevated their role to security admin, an entry is created in the sysevent table.
Unfortunately, the sysevent table is on a daily rotation and these event records will only be available for a week. One way of preserving this data is to create a scheduled job to search for these records in the sysevent table once a week to copy these records to another table to store them in a more permanent basis.