Job Title : SAP Cloud ERP Security
Identity Access Management Lead
Location : Chicago, IL
Role Overview
SAP Cloud ERP security
IAM Lead Own the security, identity, authorization, and user-access operating model for SAP S/4HANA Cloud Public Edition and its SAP identity dependencies. Lead business-role architecture, business catalogs/IAM apps, authorization restrictions, business-user lifecycle, SAP Cloud Identity Services integration, segregation-of-duties controls, privileged/technical access governance, audit readiness, production access support, and release-impact assessment in a post-go-live cloud ERP environment.
Key Responsibilities
Own the SAP S/4HANA Cloud Public Edition identity and access management strategy, authorization architecture, standards, and post-go-live operating model.
Design and govern business roles using business catalogs, IAM apps, restriction types, authorization groups, and leading/derived business-role patterns where appropriate.
Establish least-privilege access profiles aligned to enterprise job functions, organizational scope, regulatory requirements, and business-process responsibilities.
Own business-user access lifecycle processes covering onboarding, role assignment, job/organizational changes, temporary access, lock/unlock, validity, and termination-related access removal.
Partner with HR identity-source and enterprise IAM teams to ensure worker/business-user lifecycle events result in accurate and timely SAP access changes.
Lead integration and operational governance for SAP Cloud Identity Services, including Identity Authentication and Identity Provisioning, as used with S/4HANA Cloud Public Edition.
Define and enforce segregation-of-duties and sensitive-access controls in partnership with Risk, Internal Audit, Compliance, and business process owners.
Establish role-design standards that minimize excessive access and prevent unintended authorization expansion caused by overlapping role assignments and restrictions.
Lead access-risk analysis, role remediation, periodic access reviews, certification campaigns, and evidence preparation using enterprise governance tooling where deployed.
Own security design and approval for emergency, privileged, administrative, support, communication, and other technical access relevant to the SAP application landscape.
Analyze production authorization failures and distinguish role/catalog/restriction issues from identity provisioning, authentication, application configuration, or functional-process issues.
Define access requirements and security acceptance criteria for new SAP functionality, integrations, extensions, Fiori applications, and business-process changes.
Maintain role catalogs, role-to-job mappings, access matrices, restriction designs, naming standards, decision records, operating procedures, and audit evidence.
Lead security regression and authorization validation for SAP releases, configuration changes, new apps/IAM content, and organizational changes.
Review SAP release changes affecting IAM objects, business catalogs, IAM apps, restriction types, business-role templates, identity provisioning, and authentication.
Provide quality oversight for SI/security analysts and ensure production access changes follow approved governance, testing, transport/deployment, and audit standards.
Drive continuous improvement through access automation, role simplification, orphan/excess-access reduction, stronger monitoring, and measurable service-level performance.
SAP / Product-Specific Responsibilities
SAP S/4HANA Cloud Public Edition Identity and Access Management, including Maintain Business Users, Maintain Business Roles, IAM Information System, business catalogs, IAM apps, business-role templates, restriction types, and authorization groups.
Design and maintain authorization restrictions by organizational/data scope, including read/write access and relevant authorization-group controls.
Use leading and derived business roles where appropriate to standardize common access while supporting controlled organizational variations.
Govern business-role transport/deployment across the SAP S/4HANA Cloud Public Edition landscape using supported software-collection/configuration lifecycle processes.
SAP Cloud Identity Services Identity Authentication for authentication/SSO scenarios and Identity Provisioning for supported identity provisioning/synchronization scenarios.
Coordinate SAP BTP role and role-collection requirements with the BTP Technical Lead; this role governs access requirements and controls while platform-specific application engineering remains with the technical team.
Govern access dependencies for SAP Central Business Configuration, SAP Cloud ALM, integrations/communication arrangements, and connected SAP applications where included in the enterprise IAM model.
Partner with Ariba, Fieldglass, BTP, and other application owners on cross-platform identity/access standards without assuming direct configuration ownership for every connected product.
Operational Responsibilities
Own daily SAP access-management service health, authorization incident triage, access-request escalations, and recurring-problem elimination.
Establish operational monitoring for failed provisioning, inactive/locked users, inappropriate access, role-assignment anomalies, and authentication/access failures.
Run periodic role and access reviews, remove obsolete access, and maintain evidence required for internal/external audits.
Coordinate high-priority access during financial close, procurement cycles, project billing, production incidents, and release hypercare without bypassing required controls.
Maintain an IAM release/regression calendar aligned with SAP cloud releases and enterprise organizational changes.
Track SAP support incidents related to authorization, IAM, Identity Authentication, or Identity Provisioning through resolution and validate production fixes.
Cross-Functional Collaboration
Enterprise Cybersecurity, Corporate IAM, Internal Audit, Risk
Compliance, HR/HCM, Finance, Professional Services, Procurement, SAP functional leads, SAP BTP/Technical Lead, Integration, Security Operations, Service Management, QA/Release Management, Enterprise Architecture, SAP support, and system-integrator security resources.
Required Qualifications
Bachelor s degree in Cybersecurity, Information Systems, Computer Science, Engineering, or related discipline, or equivalent professional experience.
8+ years of SAP security, authorization, or identity/access-management experience, including senior design or leadership responsibility.
Hands-on experience designing SAP S/4HANA authorization models; SAP S/4HANA Cloud Public Edition IAM experience strongly preferred.
Demonstrated experience with business-role design, least privilege, organizational restrictions, user lifecycle, access reviews, and segregation-of-duties controls.
Experience integrating SAP applications with enterprise identity providers and identity provisioning processes.
Strong production-support experience covering authorization troubleshooting, access governance, audit evidence, and high-severity access incidents.
Required Technical / Functional Skills
SAP S/4HANA Cloud Public Edition business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.
SAP Cloud Identity Services: Identity Authentication and Identity Provisioning concepts, trust/authentication, provisioning jobs, source/target systems, mappings, and troubleshooting.
Role-based access control, least privilege, segregation of duties, sensitive/privileged access, access certification, and joiner-mover-leaver controls.
SAP Fiori authorization concepts and role-to-application access design.
SAP BTP roles/role collections and SAP Central Business Configuration access concepts sufficient to govern cross-platform access.
Identity federation/SSO concepts, SAML/OIDC awareness, SCIM/provisioning concepts, certificates/technical identities, and secure authentication patterns.
Audit controls, evidence management, access-risk remediation, incident/problem management, testing, and release impact assessment.
Preferred Qualifications
Experience in a regulated or audit-intensive professional-services, financial-services, accounting, or global enterprise environment.
Experience with SAP Cloud Identity Access Governance or another enterprise IGA/GRC platform for access requests, risk analysis, access certification, and privileged-access governance.
Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider.
Experience governing security across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and other connected cloud applications.
Knowledge of ITGC/SOX controls, audit evidence requirements, ISO 27001/NIST-aligned security practices, and ITIL service-management processes..