SAP Cloud ERP Security & Identity Access Management Lead

RED Global; United States; Remote; USD 150,000 - 190,000; Full time

Job summary

RED Global is seeking an SAP Cloud ERP Security & Identity Access Management Lead for a remote, 1-year contract (with 20% travel).The role focuses on designing authorization restrictions, standardizing access using business roles, and governing RBAC across the SAP S/4HANA Cloud Public Edition landscape.

You will lead identity authentication, provisioning, and security configurations, coordinating with SAP BTP security and the BTP Lead to ensure seamless enterprise IAM coverage.

Qualifications

• Experts with SAP S/4HANA Cloud Public/Private Edition security.
• Proficient in SAP business roles, catalogs, restrictions, and authorization concepts.
• Experience designing and maintaining RBAC for SAP environments.
• Knowledge of SAP Fiori security, catalogs, spaces, pages, and app access.
• Understanding of SAP BTP security and identity services.
• Experience with SAP cloud implementations, upgrades, and security deployments.

Responsibilities

• Design and maintain authorization restrictions by organizational scope.
• Use business roles to standardize access while allowing variations.
• Govern role transport across SAP S/4HANA Cloud Public Edition landscapes.
• Manage Identity Authentication for SSO and provisioning for identity sync.
• Coordinate SAP BTP role-collection requirements with the BTP Technical Lead.
• Govern access dependencies for SAP Central Business Configuration and SAP Cloud ALM.

Skills

SAP S/4HANA Cloud

RBAC design

Fiori security

IAM strategy

SAML 2.0

OAuth 2.0

OIDC

MFA concepts

SCIM provisioning

Azure AD

Tools

SAP BTP security

Job description

RED is looking for an SAP Cloud ERP Security & Identity Access Management Lead, REMOTE for a 1 year contract (with 20% travel) with one of our biggest global clients!

• Design and maintain authorization restrictions by organizational/data scope
• Use leading and derived business roles to standardize common access while supporting controlled organizational variations.
• Govern business-role transport/deployment across the SAP S/4HANA Cloud Public Edition landscape using supported software-collection/configuration lifecycle processes.
• Identity Authentication for authentication/SSO scenarios and Identity Provisioning for supported identity provisioning/synchronization scenarios.
• Coordinate SAP BTP role-collection requirements with the BTP Technical Lead
• Govern access dependencies for SAP Central Business Configuration, SAP Cloud ALM, integrations/communication arrangements, and connected SAP applications where included in the enterprise IAM model.

Skills required:

SAP Cloud ERP security expertise

• Strong experience with SAP S/4HANA Cloud Public Edition and/or Private Edition security.
• Expertise in SAP business roles, business catalogs, restrictions, and authorization concepts.
• Experience designing, configuring, and maintaining SAP role-based access controls (RBAC).
• Knowledge of SAP Fiori security, catalogs, spaces, pages, and application access.
• Understanding of SAP BTP security and identity services.
• Experience with SAP cloud implementations, system upgrades, and security deployments.

2. Identity and Access Management (IAM)

• Expertise in Identity and Access Management (IAM) strategy, design, and implementation.
• Experience with Single Sign-On (SSO), Security Assertion Markup Language (SAML 2.0), OAuth 2.0, and OpenID Connect (OIDC).
• Knowledge of identity federation, authentication, authorization, and user provisioning.
• Experience integrating SAP Cloud ERP with corporate identity providers such as Microsoft Entra ID (Azure AD) or Okta.
• Understanding of Multi-Factor Authentication (MFA) and conditional access policies.
• Experience managing user lifecycle processes, including joiner, mover, and leaver workflows.
• Knowledge of SCIM provisioning and identity synchronization.