SAP Cloud ERP Security & Identity Access Management Lead
Location: Remote
Onsite Requirements: 10% Travel
Compensation Range: $95-105/hour
Introduction
We are seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition.
This role will establish and maintain a secure, audit-ready access operating model across business roles, SAP Cloud Identity Services, segregation-of-duties controls, and production support. The ideal candidate combines hands-on SAP security expertise with leadership experience in governance, access lifecycle management, and cloud ERP operations.
Day-to-Day Responsibilities
• Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post-go-live operating model.
• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.
• Establish least-privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.
• Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination.
• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.
• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.
• Establish segregation-of-duties controls and sensitive-access governance with Risk, Compliance, Internal Audit, and business owners.
• Lead access-risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.
• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.
• Troubleshoot authorization failures and distinguish role-design issues from provisioning, authentication, configuration, or functional problems.
• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.
• Maintain role catalogs, access matrices, role-to-job mappings, restriction designs, procedures, and audit documentation.
• Lead security regression testing and release-impact assessments for SAP cloud releases and organizational changes.
• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.
• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.
Required Skills & Qualifications
• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent experience.
• 8+ years of SAP security, authorization, or IAM experience, including senior design or leadership responsibilities.
• Strong knowledge of SAP S/4HANA authorization models, preferably SAP S/4HANA Cloud Public Edition.
• Experience with business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.
• Experience with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, trust configuration, provisioning jobs, mappings, and troubleshooting.
• Strong understanding of role-based access control, least privilege, segregation of duties, and privileged access.
• Experience managing joiner-mover-leaver processes, access reviews, and access certification.
• Knowledge of enterprise identity providers, SSO/federation, SAML/OIDC, SCIM, certificates, and technical identities.
• Understanding of SAP Fiori authorization and role-to-application access design.
• Familiarity with SAP BTP roles and role collections, plus SAP Central Business Configuration access concepts.
• Experience with audit controls, evidence management, access-risk remediation, production support, and release testing.
• Strong communication and collaboration skills across technical, functional, security, and business teams.
Preferred Skills & Qualifications
• Experience in regulated or audit-intensive professional services, financial services, accounting, or global enterprise environments.
• Experience with SAP Cloud Identity Access Governance or enterprise IGA/GRC platforms for access requests, risk analysis, and certification.
• Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider.
• Experience governing access across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and connected cloud applications.
• Knowledge of ITGC/SOX controls, ISO 27001, NIST-aligned security practices, and ITIL service management.
• Experience with leading and derived business roles and supported business-role deployment processes in SAP S/4HANA Cloud Public Edition.
• Experience supporting high-priority access needs during financial close, procurement cycles, production incidents, and release hypercare while maintaining required controls.
#TECH #REMOTE