SAP Cloud ERP Security & Identity Access Management Lead

Job title: SAP Cloud ERP Security & Identity Access Management Lead

Location: Remote

Onsite

Requirements

• 10% Travel

• Compensation Range: $95-105/hour

• Introduction

• We are seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition.

• This role will establish and maintain a secure, audit-ready access operating model across business roles, SAP Cloud Identity Services, segregation-of-duties controls, and production support. The ideal candidate combines hands-on SAP security expertise with leadership experience in governance, access lifecycle management, and cloud ERP operations.

• Day-to-Day Responsibilities

• Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post-go-live operating model.

• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.

• Establish least-privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.

• Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination.

• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.

• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.

• Establish segregation-of-duties controls and sensitive-access governance with Risk, Compliance, Internal Audit, and business owners.

• Lead access-risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.

• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.

• Troubleshoot authorization failures and distinguish role-design issues from provisioning, authentication, configuration, or functional problems.

• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.

• Maintain role catalogs, access matrices, role-to-job mappings, restriction designs, procedures, and audit documentation.

• Lead security regression testing and release-impact assessments for SAP cloud releases and organizational changes.

• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.

• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.

• Required Skills & Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent experience.

• 8+ years of SAP security, authorization, or IAM experience, including senior design or leadership responsibilities.

• Strong knowledge of SAP S/4HANA authorization models, preferably SAP S/4HANA Cloud Public Edition.

• Experience with business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.

• Experience with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, trust configuration, provisioning jobs, mappings, and troubleshooting.

• Strong understanding of role-based access control, least privilege, segregation of duties, and privileged access.

• Experience managing joiner-mover-leaver processes, access reviews, and access certification.

• Knowledge of enterprise identity providers, SSO/federation, SAML/OIDC, SCIM, certificates, and technical identities.

• Understanding of SAP Fiori authorization and role-to-application access design.

• Familiarity with SAP BTP roles and role collections, plus SAP Central Business Configuration access concepts.

• Experience with audit controls, evidence management, access-risk remediation, production support, and release testing.

• Strong communication and collaboration skills across technical, functional, security, and business teams.

• Preferred Skills & Qualifications

• Experience in regulated or audit-intensive professional services, financial services, accounting, or global enterprise environments.

• Experience with SAP Cloud Identity Access Governance or enterprise IGA/GRC platforms for access requests, risk analysis, and certification.

• Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider.

• Experience governing access across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and connected cloud applications.

• Knowledge of ITGC/SOX controls, ISO 27001, NIST-aligned security practices, and ITIL service management.

• Experience with leading and derived business roles and supported business-role deployment processes in SAP S/4HANA Cloud Public Edition.

• Experience supporting high-priority access needs during financial close, procurement cycles, production incidents, and release hypercare while maintaining required controls.

• TECH REMOTE LI-DB1

• EEO Statement

• The staffing industry has seen an increase in people falsely representing themselves as recruiters to gather personal information from job seekers. For your safety, do not provide sensitive data to anyone you have not spoken with thoroughly, never provide banking information during the application process, and always double check the email address of the Recruiter to ensure it’s from an official Planet domain and not a domain with an alternative extension like .net, .org, or .jobs.

• The Planet Group and our companies are equal opportunity employers. It is our practice not to discriminate against any employee or applicant based on any criteria, condition or basis protected by laws or regulations in the locations where we do business. All qualified applicants are encouraged to apply. We celebrate diversity and are committed to providing an environment of mutual respect. We believe that diversity, equity, and inclusion enable us to better meet our mission and values while serving our clients across the globe. If you have a disability or handicap and would like us to accommodate you in any reasonable way, please inform your recruiter, or contact us, so that we can discuss the appropriate alternatives available.