SAP Platform Security Architect

Ford-Motor-Company; Dearborn (MI); On-site; USD 150,000 - 190,000; Full time

Job summary

Ford Motor Company seeks a SAP Platform Security Architect (SAP RISE) to define and govern security architecture across a large SAP landscape, supporting Purchasing, Finance, Treasury, Material Management & Planning (MMP), and more than 60 Agile Product Teams.

This role establishes enterprise security standards, architecture patterns, governance, and technical direction to ensure secure, scalable SAP platforms.

Job description

SAP Platform Security Architect (SAP RISE)

Position Summary

The SAP Platform Security Architect is responsible for defining, governing, and evolving the enterprise security architecture for a large-scale SAP RISE environment supporting Purchasing, Finance, Treasury, Material Management & Planning (MMP), and more than 60 Agile Product Teams. This role establishes enterprise security standards, architecture patterns, governance, and technical direction to ensure secure, scalable, and compliant SAP platforms.

The architect partners with Enterprise Architecture, Product Teams, Platform Engineering, Identity Services, Cybersecurity, Infrastructure, and Business stakeholders to ensure SAP security is implemented consistently across cloud and hybrid environments while enabling rapid delivery of business capabilities.

This role is accountable for the long-term security strategy of the SAP platform rather than day-to-day operational security administration.

Primary Responsibilities

Enterprise SAP Security Architecture

• Define the enterprise SAP Security Reference Architecture.
• Develop security patterns for SAP RISE and hybrid landscapes.
• Govern security architecture across more than 60 product teams.
• Establish platform security standards and reusable design patterns.
• Lead architecture reviews for new SAP capabilities.
• Review solution designs before implementation.
• Define security guardrails for all SAP products.
• Ensure alignment with Enterprise Architecture principles.
• Maintain platform security roadmaps.

SAP Identity and Access Management

• Design and govern enterprise identity architecture including:
• Microsoft Entra ID
• SAP Identity Authentication Service (IAS)
• SAP Identity Provisioning Service (IPS)
• SAP Access Control
• SAP Cloud Identity Services
• SAP Identity Access Governance (IAG)
• Privileged Access Management integration
• Single Sign-On (SSO)
• Multi-Factor Authentication (MFA)
• OAuth 2.0
• OpenID Connect
• SAML
• SCIM provisioning

Authorization Architecture

• Provide enterprise guidance for:
• Role design standards
• Business role architecture
• Technical role architecture
• Derived role strategy
• Composite role strategy
• Organizational level security
• Fiori Catalogs
• Fiori Spaces
• Fiori Pages
• Authorization Objects
• CDS Authorization
• RAP authorization concepts
• Embedded Analytics security

SAP RISE Security

• Provide architecture and governance for:
• SAP S/4HANA RISE
• SAP Business Technology Platform (BTP)
• SAP Integration Suite
• SAP Build
• SAP Build Process Automation
• SAP Event Mesh
• SAP Work Zone
• SAP Mobile Services
• SAP Joule and AI capabilities
• SAP Datasphere
• SAP Analytics Cloud
• SAP Cloud ALM

Platform Security Governance

• Establish governance across all Product Teams by:
• Reviewing architecture designs.
• Defining secure implementation patterns.
• Maintaining security standards.
• Driving architecture consistency.
• Reviewing exception requests.
• Managing technical debt.
• Publishing reference architectures.
• Leading security design reviews.
• Approving security architecture decisions.

Security Risk Management

• Lead architecture for:
• Segregation of Duties (SoD)
• Sensitive Access
• Emergency Access (Firefighter)
• Privileged Access
• Critical Transaction Monitoring
• Platform Risk Assessments
• Threat Modeling
• Security Exception Management
• Audit Readiness
• Compliance Reporting

Cloud Security

• Provide architecture for:
• Network segmentation
• Private Link
• Secure connectivity
• Encryption at rest
• Encryption in transit
• Key Management
• Certificate Management
• Secrets Management
• API Security
• WAF integration