SAP Cloud ERP Security & Identity Access Management Lead

Planet Group; Chicago (IL); Remote; USD 131,000 - 145,000; Full time

Job summary

Planet Group is seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own the security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition. The role requires leadership in governance, access lifecycle, and cloud ERP operations across the SAP landscape.

The candidate will design roles, manage access lifecycles, and collaborate with IAM and HR teams to align identity events with SAP access changes,

Qualifications

• Bachelor's degree in cybersecurity or related field.
• 8+ years SAP security/IAM experience with senior design leadership.
• Strong knowledge of S/4HANA authorization models.

Responsibilities

• Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post‑go‑live operating model.
• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.
• Establish least‑privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.
• Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination.
• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.
• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.
• Establish segregation‑of‑duties controls and sensitive‑access governance with Risk, Compliance, Internal Audit, and business owners.
• Lead access‑risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.
• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.
• Troubleshoot authorization failures and distinguish role‑design issues from provisioning, authentication, configuration, or functional problems.
• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.
• Maintain role catalogs, access matrices, role‑to‑job mappings, restriction designs, procedures, and audit documentation.
• Lead security regression testing and release‑impact assessments for SAP cloud releases and organizational changes.
• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.
• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.

Skills

SAP security

IAM experience

S/4HANA authorization

RBAC

Access governance

Communication skills

Education

Bachelor's degree in Cybersecurity

Tools

SAP Cloud Identity Services

Microsoft Entra ID

SAP Ariba

Job description

SAP Cloud ERP Security & Identity Access Management Lead

Location:Remote
Onsite Requirements: 10% Travel
Compensation Range:$95-105/hour

Introduction

We are seeking an experienced SAP Cloud ERP Security & Identity Access Management Lead to own security architecture, identity management, authorization design, and user-access governance for SAP S/4HANA Cloud Public Edition.

This role will establish and maintain a secure, audit-ready access operating model across business roles, SAP Cloud Identity Services, segregation‑of‑duties controls, and production support. The ideal candidate combines hands‑on SAP security expertise with leadership experience in governance, access lifecycle management, and cloud ERP operations.

Day‑to‑Day Responsibilities

• Own SAP S/4HANA Cloud Public Edition security strategy, authorization architecture, standards, and post‑go‑live operating model.

• Design and govern business roles, business catalogs, IAM apps, restriction types, and authorization groups.

• Establish least‑privilege access aligned with job functions, organizational scope, business processes, and regulatory requirements.

• Manage user access lifecycles, including onboarding, role changes, temporary access, lock/unlock, and termination.

• Partner with Corporate IAM and HR teams to align identity lifecycle events with SAP access changes.

• Govern SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, SSO, and provisioning processes.

• Establish segregation‑of‑duties controls and sensitive‑access governance with Risk, Compliance, Internal Audit, and business owners.

• Lead access‑risk analysis, role remediation, periodic access reviews, certification campaigns, and audit evidence preparation.

• Govern emergency, privileged, administrative, support, communication, and technical access across the SAP landscape.

• Troubleshoot authorization failures and distinguish role‑design issues from provisioning, authentication, configuration, or functional problems.

• Define security requirements for new SAP functionality, integrations, extensions, Fiori applications, and process changes.

• Maintain role catalogs, access matrices, role‑to‑job mappings, restriction designs, procedures, and audit documentation.

• Lead security regression testing and release‑impact assessments for SAP cloud releases and organizational changes.

• Oversee security analysts and system integrators, ensuring access changes follow approved governance, testing, and deployment standards.

• Improve access automation, role simplification, monitoring, and reduction of excessive or obsolete access.

Required Skills & Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Engineering, or equivalent experience.

• 8+ years of SAP security, authorization, or IAM experience, including senior design or leadership responsibilities.

• Strong knowledge of SAP S/4HANA authorization models, preferably SAP S/4HANA Cloud Public Edition.

• Experience with business users, business roles, business catalogs, IAM apps, restriction types, authorization groups, and IAM Information System.

• Experience with SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, trust configuration, provisioning jobs, mappings, and troubleshooting.

• Strong understanding of role‑based access control, least privilege, segregation of duties, and privileged access.

• Experience managing joiner‑mover‑leaver processes, access reviews, and access certification.

• Knowledge of enterprise identity providers, SSO/federation, SAML/OIDC, SCIM, certificates, and technical identities.

• Understanding of SAP Fiori authorization and role‑to‑application access design.

• Familiarity with SAP BTP roles and role collections, plus SAP Central Business Configuration access concepts.

• Experience with audit controls, evidence management, access‑risk remediation, production support, and release testing.

• Strong communication and collaboration skills across technical, functional, security, and business teams.

Preferred Skills & Qualifications

• Experience in regulated or audit‑intensive professional services, financial services, accounting, or global enterprise environments.

• Experience with SAP Cloud Identity Access Governance or enterprise IGA/GRC platforms for access requests, risk analysis, and certification.

• Experience integrating SAP Cloud Identity Services with Microsoft Entra ID or another corporate identity provider.

• Experience governing access across SAP Ariba, SAP Fieldglass, SAP BTP, SAP Cloud ALM, and connected cloud applications.

• Knowledge of ITGC/SOX controls, ISO 27001, NIST‑aligned security practices, and ITIL service management.

• Experience with leading and derived business roles and supported business‑role deployment processes in SAP S/4HANA Cloud Public Edition.

• Experience supporting high‑priority access needs during financial close, procurement cycles, production incidents, and release hypercare while maintaining required controls.

#TECH #REMOTE #LI-DB1