Role: SAP Cloud ERP Security & IAM Lead

Location: Remote – US (Travel as needed)
Duration: 12+ Months

Role Overview:

We are seeking an experienced SAP Cloud ERP Security & Identity Access Management (IAM) Lead to own security architecture, authorization design, identity integration, and access governance for SAP S/4HANA Cloud Public Edition. The role will oversee business-role management, user lifecycle processes, access-risk controls, production security support, and compliance in a post-go-live environment.

Key Responsibilities:

• Lead SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, role design standards, and ongoing access governance.

• Design and maintain business roles, business catalogs, IAM apps, authorization groups, restriction types, and leading/derived role structures while enforcing least-privilege access.

• Govern the complete business-user lifecycle, including onboarding, role assignment, organizational changes, temporary access, account locking, and timely deprovisioning.

• Manage security integration with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, identity federation, and provisioning workflows.

• Establish segregation-of-duties (SoD), sensitive-access, privileged-access, and emergency-access controls in collaboration with Risk, Compliance, Internal Audit, and business owners.

• Lead access-risk assessments, role remediation, periodic access certifications, access reviews, and audit-evidence preparation using available GRC/IGA tools.

• Govern SAP Fiori authorizations and coordinate access requirements for SAP BTP, Central Business Configuration, SAP Cloud ALM, Ariba, Fieldglass, and connected applications.

• Troubleshoot production authorization, authentication, and provisioning issues; manage escalations and resolve recurring access problems.

• Define security requirements for new functionality, integrations, extensions, organizational changes, and SAP cloud releases.

• Lead authorization regression testing, security impact assessments, controlled role deployments, and release-readiness reviews.

• Maintain role catalogs, access matrices, role-to-job mappings, security procedures, and audit documentation.

• Improve access automation, monitoring, role simplification, and operational performance while providing technical guidance to security analysts and implementation partners.

Required Qualifications:

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent professional experience.

• 8+ years of SAP security, authorization, or IAM experience, including senior-level design or leadership responsibilities.

• Hands-on SAP S/4HANA authorization design experience; SAP S/4HANA Cloud Public Edition IAM experience strongly preferred.

• Strong understanding of business-role architecture, authorization restrictions, least privilege, user lifecycle management, SoD, and access-risk remediation.

• Experience integrating SAP applications with enterprise identity providers and provisioning platforms.

• Expertise in SAP Cloud Identity Services, Identity Authentication, Identity Provisioning, SAP Fiori authorization, and role-based access control.

• Working knowledge of SAML, OIDC, SCIM, SSO, identity federation, certificates, technical identities, and secure authentication.

• Experience with production support, access incident troubleshooting, security testing, release management, and audit readiness.

Preferred Qualifications:

• Experience with SAP Cloud Identity Access Governance or enterprise GRC/IGA platforms.

• Familiarity with Microsoft Entra ID and integrations across SAP BTP, Ariba, Fieldglass, and other SAP cloud applications.

• Experience in financial services, professional services, accounting, or other regulated enterprise environments.

• Knowledge of SOX/ITcontrols, ISO 27001, NIST, and ITIL service-management practices.

Cross-Functional Collaboration:

Work closely with Corporate IAM, Cybersecurity, HR/HCM, Finance, Procurement, Risk, Compliance, Internal Audit, SAP functional and technical teams, BTP architects, Integration, QA/Release Management, Service Management, and SAP implementation partners.

Success Measures:

Maintain least-privilege access, reliable identity provisioning, effective SoD controls, timely access reviews, audit readiness, stable production support, and secure SAP cloud releases.