SAP Cloud ERP Security & Identity Access Management Lead

Role Overview

We are seeking an experienced SAP Cloud ERP Security & Identity Access Management (IAM) Lead to own security architecture, authorization design, identity integration, and access governance for SAP S/4HANA Cloud Public Edition.

The role will oversee business-role management, user lifecycle processes, access-risk controls, production security support, and compliance in a post-go-live environment.

Key Responsibilities

• Lead SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, role design standards, and ongoing access governance.
• Design and maintain business roles, business catalogs, IAM apps, authorization groups, restriction types, and leading/derived role structures while enforcing least-privilege access.
• Govern the complete business-user lifecycle, including onboarding, role assignment, organizational changes, temporary access, account locking, and timely deprovisioning.
• Manage security integration with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, identity federation, and provisioning workflows.
• Establish segregation-of-duties (SoD), sensitive-access, privileged-access, and emergency-access controls in collaboration with Risk, Compliance, Internal Audit, and business owners.
• Lead access-risk assessments, role remediation, periodic access certifications, access reviews, and audit-evidence preparation using available GRC/IGA tools.
• Govern SAP Fiori authorizations and coordinate access requirements for SAP BTP, Central Business Configuration, SAP Cloud ALM, Ariba, Fieldglass, and connected applications.
• Troubleshoot production authorization, authentication, and provisioning issues; manage escalations and resolve recurring access problems.
• Define security requirements for new functionality, integrations, extensions, organizational changes, and SAP cloud releases.
• Lead authorization regression testing, security impact assessments, controlled role deployments, and release-readiness reviews.
• Maintain role catalogs, access matrices, role-to-job mappings, security procedures, and audit documentation.
• Improve access automation, monitoring, role simplification, and operational performance while providing technical guidance to security analysts and implementation partners.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent professional experience.
• 8+ years of SAP security, authorization, or IAM experience, including senior-level design or leadership responsibilities.
• Hands-on SAP S/4HANA authorization design experience; SAP S/4HANA Cloud Public Edition IAM experience strongly preferred.
• Strong understanding of business-role architecture, authorization restrictions, least privilege, user lifecycle management, SoD, and access-risk remediation.
• Experience integrating SAP applications with enterprise identity providers and provisioning platforms.
• Expertise in SAP Cloud Identity Services, Identity Authentication, Identity Provisioning, SAP Fiori authorization, and role-based access control.
• Working knowledge of SAML, OIDC, SCIM, SSO, identity federation, certificates, technical identities, and secure authentication.
• Experience with production support, access incident troubleshooting, security testing, release management, and audit readiness.

Preferred Qualifications

• Experience with SAP Cloud Identity Access Governance or enterprise GRC/IGA platforms.
• Familiarity with Microsoft Entra ID and integrations across SAP BTP, Ariba, Fieldglass, and other SAP cloud applications.
• Experience in financial services, professional services, accounting, or other regulated enterprise environments.
• Knowledge of SOX/ITcontrols, ISO 27001, NIST, and ITIL service-management practices.

Cross-Functional Collaboration

Work closely with Corporate IAM, Cybersecurity, HR/HCM, Finance, Procurement, Risk, Compliance, Internal Audit, SAP functional and technical teams, BTP architects, Integration, QA/Release Management, Service Management, and SAP implementation partners.

Success Measures

Maintain least-privilege access, reliable identity provisioning, effective SoD controls, timely access reviews, audit readiness, stable production support, and secure SAP cloud releases.