SAP Cloud ERP Security & Identity Access Management Lead

Location:Remote
Onsite Requirements: 10% Travel
Compensation Range:$95-105/hour

We are seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own security architecture, identity management, authorization design, and user-access governance for SAP S/4

HANA Cloud Public Edition.

This role will establish and maintain a secure, audit-ready access operating model across business roles, SAP Cloud Identity Services, segregation‑of‑duties controls, and production support. The ideal candidate combines hands‑on SAP security expertise with leadership experience in governance, access lifecycle management, and cloud ERP operations.

• Own SAP S/4
  
  HANA Cloud Public Edition security strategy, authorization architecture, standards, and post‑go‑live operating model.

• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.

• Establish least‑privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.

• Manage user access life cycles, including onboarding, role changes, temporary access, lock/unlock, and termination.

• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.

• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.

• Establish segregation‑of‑duties controls and sensitive‑access governance with Risk, Compliance, Internal Audit, and business owners.

• Lead access‑risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.

• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.

• Troubleshoot authorization failures and distinguish role‑design issues from provisioning, authentication, configuration, or functional problems.

• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.

• Maintain role catalogs, access matrices, role‑to‑job mappings, restriction designs, procedures, and audit documentation.

• Lead security regression testing and release‑impact assessments for SAP cloud releases and organizational changes.

• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.

• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent experience.

• 8+ years of SAP security, authorization, or IAM experience, including senior design or leadership responsibilities.

• Strong knowledge of SAP S/4
  
  HANA authorization models, preferably SAP S/4
  
  HANA Cloud Public Edition.

• Experience with business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.

• Experience with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, trust configuration, provisioning jobs, mappings, and troubleshooting.

• Strong understanding of role‑based access control, least privilege, segregation of duties, and privileged access.

• Experience managing joiner‑mover‑leaver processes, access reviews, and access certification.

• Knowledge of enterprise identity providers, SSO/federation, SAML/OIDC, SCIM, certificates, and technical identities.

• Understanding of SAP Fiori authorization and role‑to‑application access design.

• Familiarity with SAP BTP roles and role collections, plus SAP Central Business Configuration access…