SAP Cloud ERP security & IAM Lead

SAP Cloud ERP security & IAM Lead Own the security, identity, authorization, and user-access operating model for SAP S/4HANA Cloud Public Edition and its SAP identity dependencies. Lead business-role architecture, business catalogs/IAM apps, authorization restrictions, business-user lifecycle, SAP Cloud Identity Services integration, segregation-of-duties controls, privileged/technical access governance, audit readiness, production access support, and release-impact assessment in a post-go-live cloud ERP environment., * SAP S/4HANA Cloud Public Edition business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.

• SAP Cloud Identity Services: Identity Authentication and Identity Provisioning concepts, trust/authentication, provisioning jobs, source/target systems, mappings, and troubleshooting.
• Role-based access control, least privilege, segregation of duties, sensitive/privileged access, access certification, and joiner-mover-leaver controls.
• SAP Fiori authorization concepts and role-to-application access design.
• SAP BTP roles/role collections and SAP Central Business Configuration access concepts sufficient to govern cross-platform access.
• Identity federation/SSO concepts, SAML/OIDC awareness, SCIM/provisioning concepts, certificates/technical identities, and secure authentication patterns.
• Audit controls, evidence management, access-risk remediation, incident/problem management, testing, and release impact assessment., * Own the SAP S/4HANA Cloud Public Edition identity and access management strategy, authorization architecture, standards, and post-go-live operating model.
• Design and govern business roles using business catalogs, IAM apps, restriction types, authorization groups, and leading/derived business-role patterns where appropriate.
• Establish least-privilege access profiles aligned to enterprise job functions, organizational scope, regulatory requirements, and business-process responsibilities.
• Own business-user access lifecycle processes covering onboarding, role assignment, job/organizational changes, temporary access, lock/unlock, validity, and termination-related access removal.
• Partner with HR identity-source and enterprise IAM teams to ensure worker/business-user lifecycle events result in accurate and timely SAP access changes.
• Lead integration and operational governance for SAP Cloud Identity Services, including Identity Authentication and Identity Provisioning, as used with S/4HANA Cloud Public Edition.
• Define and enforce segregation-of-duties and sensitive-access controls in partnership with Risk, Internal Audit, Compliance, and business process owners.
• Establish role-design standards that minimize excessive access and prevent unintended authorization expansion caused by overlapping role assignments and restrictions.
• Lead access-risk analysis, role remediation, periodic access reviews, certification campaigns, and evidence preparation using enterprise governance tooling where deployed.
• Own security design and approval for emergency, privileged, administrative, support, communication, and other technical access relevant to the SAP application landscape.
• Analyze production authorization failures and distinguish role/catalog/restriction issues from identity provisioning, authentication, application configuration, or functional-process issues.
• Define access requirements and security acceptance criteria for new SAP functionality, integrations, extensions, Fiori applications, and business-process changes.
• Maintain role catalogs, role-to-job mappings, access matrices, restriction designs, naming standards, decision records, operating procedures, and audit evidence.
• Lead security regression and authorization validation for SAP releases, configuration changes, new apps/IAM content, and organizational changes.
• Review SAP release changes affecting IAM objects, business catalogs, IAM apps, restriction types, business-role templates, identity provisioning, and authentication.
• Provide quality oversight for SI/security analysts and ensure production access changes follow approved governance, testing, transport/deployment, and audit standards.
• Drive continuous improvement through access automation, role simplification, orphan/excess-access reduction, stronger monitoring, and measurable service-level performance.

SAP / Product-Specific Responsibilities

• SAP S/4HANA Cloud Public Edition Identity and Access Management, including Maintain Business Users, Maintain Business Roles, IAM Information System, business catalogs, IAM apps, business-role templates, restriction types, and authorization groups.
• Design and maintain authorization restrictions by organizational/data scope, including read/write access and relevant authorization-group controls.
• Use leading and derived business roles where appropriate to standardize common access while supporting controlled organizational variations.
• Govern business-role transport/deployment across the SAP S/4HANA Cloud Public Edition landscape using supported software-collection/configuration lifecycle processes.
• SAP Cloud Identity Services - Identity Authentication for authentication/SSO scenarios and Identity Provisioning for supported identity provisioning/synchronization scenarios.
• Coordinate SAP BTP role and role-collection requirements with the BTP Technical Lead; this role governs access requirements and controls while platform-specific application engineering remains with the technical team.
• Govern access dependencies for SAP Central Business Configuration, SAP Cloud ALM, integrations/communication arrangements, and connected SAP applications where included in the enterprise IAM model.
• Partner with Ariba, Fieldglass, BTP, and other application owners on cross-platform identity/access standards without assuming direct configuration ownership for every connected product.

Operational Responsibilities

• Own daily SAP access-management service health, authorization incident triage, access-request escalations, and recurring-problem elimination.
• Establish operational monitoring for failed provisioning, inactive/locked users, inappropriate access, role-assignment anomalies, and authentication/access failures.
• Run periodic role and access reviews, remove obsolete access, and maintain evidence required for internal/external audits.
• Coordinate high-priority access during financial close, procurement cycles, project billing, production incidents, and release hypercare without bypassing required controls.
• Maintain an IAM release/regression calendar aligned with SAP cloud releases and enterprise organizational changes.
• Track SAP support incidents related to authorization, IAM, Identity Authentication, or Identity Provisioning through resolution and validate production fixes.
• Cross-Functional Collaboration
• Enterprise Cybersecurity, Corporate IAM, Internal Audit, Risk & Compliance, HR/HCM, Finance, Professional Services, Procurement, SAP functional leads, SAP BTP/Technical Lead, Integration, Security Operations, Service Management, QA/Release Management, Enterprise Architecture, SAP support, and system-integrator security resources.

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related discipline, or equivalent professional experience.
• 8+ years of SAP security, authorization, or identity/access-management experience, including senior design or leadership responsibility.
• Hands-on experience designing SAP S/4HANA authorization models; SAP S/4HANA Cloud Public Edition IAM experience strongly preferred.
• Demonstrated experience with business-role design, least privilege, organizational restrictions, user lifecycle, access reviews, and segregation-of-duties controls.
• Experience integrating SAP applications with enterprise identity providers and identity provisioning processes.
• Strong production-support experience covering authorization troubleshooting, access governance, audit evidence, and high-severity access incidents., * Experience in a regulated or audit-intensive professional-services, financial-services, accounting, or global enterprise environment.
• Experience with SAP Cloud Identity Access Governance or another enterprise IGA/GRC platform for access requests, risk analysis, access certification, and privileged-access governance.
• Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider.
• Experience governing security across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and other connected cloud applications.
• Knowledge of ITGC/SOX controls, audit evidence requirements, ISO 27001/NIST-aligned security practices, and ITIL service-management processes..