SAP S/4HANA Security & Basis Lead

Context and Scope

As part of the digital transformation program, we are executing the strategic rollout of SAP S/4HANA across our operations in Mexico. A fundamental pillar of this implementation is establishing a robust, scalable, and compliant security and authorization model based on our global template.

This role serves as the senior technical authority and functional bridge responsible for tailoring, governing, and deploying standard template security roles within the local Mexico operating context. The incumbent will act as the pivotal connector aligning business stakeholders, Organizational Change Management (OCM), internal control/audit teams, and technical BASIS/Security delivery teams.

Scope

• Geographic & Project Scope: SAP S/4HANA Rollout Program – Mexico entities and operational sites.
• Functional & Technical Breadth: End-to-end authorization architecture, encompassing Fiori catalogs/spaces/pages, SAP S/4HANA back-end roles, Segregation of Duties (SoD) framework, user access governance, and cutover authorization strategy.
• Stakeholder Interfaces: Business Process Owners (BPOs) and Key Users across finance, supply chain, procurement, sales, and manufacturing. Organizational Change Management (OCM) and HR teams to drive role mapping, readiness, and user adoption. Global Architecture & Template Governance bodies to ensure standard compliance and manage localized exceptions. Technical BASIS, GRC, and Security implementation teams (internal and system integration partners).

Technical Leadership & Role Architecture

• Lead the security and authorization workstream for the Mexico S/4HANA rollout, ensuring alignment with global template guidelines, corporate governance, and local compliance requirements.
• Architect and oversee the configuration of role concepts across SAP S/4HANA, SAP Fiori (Launchpad, Catalogs, Groups, Spaces, and Pages), and connected SAP/non-SAP ecosystems.
• Establish clear technical specifications and guidelines for role engineering, naming conventions, authorization objects, and derived/composite role structures.

Template Adoption & Fit-Gap Analysis

• Direct the analysis and adoption of global template standard roles, evaluating local regulatory, legal, and operational nuances in Mexico.
• Drive fit-gap workshops with business leads to identify valid localization requirements versus standard template adoption opportunities, actively challenging unnecessary customizations to maintain standard core integrity.
• Formulate actionable business requirements into technical authorization specifications for the implementation partner and technical Basis/Security developers.

Business & Change Management Translation

• Translate complex technical authorization structures and security constraints into understandable business language for process owners and leadership.
• Partner closely with the Organizational Change Management (OCM) workstream to coordinate user-to-role mapping, identify impact on day-to-day job descriptions, and support business transition readiness.
• Define and support training initiatives related to role approval workflows, access requests, and end-user navigation within the new security landscape.

Governance, Risk & Compliance (GRC / SoD)

• Enforce Segregation of Duties (SoD) rules and critical access matrices in compliance with corporate risk, internal controls, and external auditing standards (e.g., SOX, local statutory requirements).
• Facilitate risk mitigation discussions with business management when operational constraints prevent clean segregation, ensuring proper compensating controls are documented and approved.
• Oversee access control workflows, emergency access management (Firefighter IDs), and privileged access management during testing, cutover, and hypercare.

Delivery, Testing & Cutover Coordination

• Lead user access definition across all project testing phases (System Integration Testing, User Acceptance Testing, and Mock Cutovers).
• Define and execute the security cutover plan, including mass user provisioning, authorization verification, and day-one access support.
• Drive hypercare support for authorization defects, ensuring prompt resolution of role bugs and establishing sustainable post-go-live operational handover to the ongoing support organization.

Education & Certifications

• Education: Bachelor’s degree in Computer Science, Information Systems, Software Engineering, Business Administration, or a related field.
• Certifications (Highly Desirable): SAP Certified Technology Associate – SAP S/4HANA System Administration / Basis. SAP Certified Technology Professional – System Security and Authorizations. Information Security or Governance certifications (e.g., CISA, CISM, CRISC) are a strong plus.

Professional Experience

• Overall SAP Experience: Minimum of 8–10 years of progressive hands-on experience in SAP Basis, SAP Security, and Authorization design.
• S/4HANA Implementation Experience: Proven track record in at least 2 full lifecycle SAP implementations/rollouts, with direct experience in SAP S/4HANA (including Fiori authorization architecture).
• Template Rollout Experience: Solid experience operating within global/regional template rollout models, balancing global governance with local business requirements.
• GRC & Access Governance: In-depth knowledge of SAP GRC Access Control (ARA, ARM, EAM, BRM) or equivalent identity and access governance platforms.

Technical & Functional Competencies

• Deep expertise in transaction codes, authorization objects, SU24 maintenance, PFCG, derived roles, composite roles, and structural authorizations.
• Strong proficiency in SAP Fiori Launchpad security: creating and maintaining Fiori business catalogs, business groups, spaces, pages, and OData/RFC authorization bindings.
• Practical understanding of SAP NetWeaver architecture, user management engine (UME), and integration with enterprise identity providers (IdP / Single Sign-On / Azure AD).
• Strong grasp of Segregation of Duties (SoD) principles, audit trail standards, and internal control frameworks.

Leadership & Soft Skills

• Leadership & Stakeholder Management: Demonstrated capability to guide cross-functional teams, navigate project resistance, and build consensus between business and technical teams.
• Communication & Translation: Outstanding ability to articulate technical security concepts to non-technical business audiences and translate business policies into technical parameters.
• Problem-Solving & Negotiation: Strong analytical mindset with the ability to manage scope trade-offs and enforce governance without stalling project momentum.
• Language Proficiency: Fluent English (mandatory) for collaboration with global template owners and regional leadership. Fluent Spanish (mandatory) for day-to-day engagement with Mexico business operations and local project teams.