SAP Cloud ERP Security & Identity Access Management Lead Location: Remote Onsite Requirements: 10% Travel Compensation Range: $95-105/hour Introduction We are seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition. This role will establish and maintain a secure, audit-ready access operating model across business roles, SAP Cloud Identity Services, segregation-of-duties controls, and production support. The ideal candidate combines hands-on SAP security expertise with leadership experience in governance, access lifecycle management, and cloud ERP operations. Day-to-Day Responsibilities • Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post-go-live operating model. • Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups. • Establish least-privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements. • Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination. • Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes. • Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes. • Establish segregation-of-duties controls and sensitive-access governance with Risk, Compliance, Internal Audit, and business owners. • Lead access-risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation. • Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape. • Troubleshoot authorization failures and distinguish role-design issues from provisioning, authentication, configuration, or functional problems. • Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes. • Maintain role catalogs, access matrices, role-to-job mappings, restriction designs, procedures, and audit documentation. • Lead security regression testing and release-impact assessments for SAP cloud releases and organizational changes. • Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards. • Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access. Required Skills & Qualifications • Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent experience. • 8+ years of SAP security, authorization, or IAM experience, including senior design or leadership responsibilities. • Strong knowledge of SAP S/4HANA authorization models, preferably SAP S/4HANA Cloud Public Edition. • Experience with business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System. • Experience with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, trust configuration, provisioning jobs, mappings, and troubleshooting. • Strong understanding of role-based access control, least privilege, segregation of duties, and privileged access. • Experience managing joiner-mover-leaver processes, access reviews, and access certification. • Knowledge of enterprise identity providers, SSO/federation, SAML/OIDC, SCIM, certificates, and technical identities. • Understanding of SAP Fiori authorization and role-to-application access design. • Familiarity with SAP BTP roles and role collections, plus SAP Central Business Configuration access concepts. • Experience with audit controls, evidence management, access-risk remediation, production support, and release testing. • Strong communication and collaboration skills across technical, functional, security, and business teams. Preferred Skills & Qualifications • Experience in regulated or audit-intensive professional services, financial services, accounting, or global enterprise environments. • Experience with SAP Cloud Identity Access Governance or enterprise IGA/GRC platforms for access requests, risk analysis, and certification. • Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider. • Experience governing access across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and connected cloud applications. • Knowledge of ITGC/SOX controls, ISO 27001, NIST-aligned security practices, and ITIL service management. • Experience with leading and derived business roles and supported business-role deployment processes in SAP S/4HANA Cloud Public Edition. • Experience supporting high-priority access needs during financial close, procurement cycles, production incidents, and release hypercare while maintaining required controls. #TECH #REMOTE #LI-DB1