Remote SAP Cloud ERP IAM Security Lead

Planet Group; Chicago (IL); Remote; USD 131,000 - 145,000; Full time

Job summary

Planet Group is seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own the security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition. The role requires leadership in governance, access lifecycle, and cloud ERP operations across the SAP landscape.

The candidate will design roles, manage access lifecycles, and collaborate with IAM and HR teams to align identity events with SAP access changes,

Qualifications

• Bachelor's degree in cybersecurity or related field.
• 8+ years SAP security/IAM experience with senior design leadership.
• Strong knowledge of S/4HANA authorization models.

Responsibilities

• Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post‑go‑live operating model.
• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.
• Establish least‑privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.
• Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination.
• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.
• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.
• Establish segregation‑of‑duties controls and sensitive‑access governance with Risk, Compliance, Internal Audit, and business owners.
• Lead access‑risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.
• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.
• Troubleshoot authorization failures and distinguish role‑design issues from provisioning, authentication, configuration, or functional problems.
• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.
• Maintain role catalogs, access matrices, role‑to‑job mappings, restriction designs, procedures, and audit documentation.
• Lead security regression testing and release‑impact assessments for SAP cloud releases and organizational changes.
• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.
• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.

Skills

SAP security

IAM experience

S/4HANA authorization

RBAC

Access governance

Communication skills

Education

Bachelor's degree in Cybersecurity

Tools

SAP Cloud Identity Services

Microsoft Entra ID

SAP Ariba

Job description

Planet Group is seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own the security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition. The role requires leadership in governance, access lifecycle, and cloud ERP operations across the SAP landscape.

The candidate will design roles, manage access lifecycles, and collaborate with IAM and HR teams to align identity events with SAP access changes,