Job Description

Job Summary

We are seeking a seasoned, hands-on SAP Security Senior Consultant to lead the technical architecture, design, and deployment of security, authorizations, and governance frameworks for enterprise-scale greenfield SAP S/4HANA Cloud, Private Edition (PCE / RISE with SAP) implementations.

In this strategic role, the Senior Consultant will serve as the core Subject Matter Expert (SME) responsible for building end-to-end authorization architectures from the ground up. This encompasses building compliant task- and job-based PFCG role structures, modern SAP Fiori Launchpad security (Catalogs, Groups, Spaces, and Pages), and enterprise-grade SAP Access Control (GRC 12.0) suites. In addition, the role drives centralized cloud identity federation and automated user provisioning leveraging SAP Cloud Identity Services (IAS / IPS) in hybrid cloud landscapes, ensuring Segregation of Duties (SOD) compliance, least-privilege principles, and robust audit readiness.

Key Responsibilities

A. Greenfield S/4HANA & SAP Fiori Security Architecture:

• End-to-End Greenfield Role Design: Architect and implement clean, scalable authorization concepts (single, derived, and composite business roles) tailored to greenfield S/4HANA Private Cloud Edition (PCE) environments.
• SAP Fiori UI Security Architecture: Design, build, and maintain Fiori Launchpad access frameworks, including Business Catalogs, Technical Catalogs, Business Groups, Spaces, and Pages.
• Authorization Optimization (SU24/SU25): Establish robust SU24 authorization default maintenance protocols; secure OData services (v2 and v4), CDS views, RFC interfaces, and Web Dynpro ABAP applications.
• Troubleshooting & Diagnostics: Conduct in-depth authorization trace analyses using ST01, STAUTHTRACE, and SU53 to rapidly diagnose and resolve access defects during project build, SIT, and UAT cycles.
• Security Runbooks & Cutover Execution: Author comprehensive security blueprints, cutover checklists, stabilization runbooks, and transport management strategies across multi-tier landscape architectures."

B. SAP Access Control Implementation & Governance:

• Access Risk Analysis (ARA): Build, customize, and validate comprehensive SOD rule-sets; establish critical actions/permissions matrices, risk classifications, and automated mitigating controls.
• Emergency Access Management (EAM): Design and configure Firefighter (ID and Role-based) architectures, decentralized FF access, firefighter log review workflows, and reason code definitions.
• Access Request Management (ARM): Architect multi-stage multi-path (MSMP) workflow paths, BRFplus decision tables/business rules, and compliant end-to-end provisioning flows.
• Business Role Management (BRM): Implement role lifecycle governance, automated SOD simulations, role approval workflows, and role ownership matrices.
• Audit & Compliance Alignment: Ensure all authorization models and GRC rule-sets strictly adhere to internal control frameworks, Sox 404 compliance, and IT General Controls (ITGC)."

C. SAP Cloud Identity Services (IAS / IPS) Integration:

• Identity Authentication Service (IAS): Configure SAP IAS as an Identity Provider (IdP) or Identity Proxy federated with enterprise Corporate IdPs (e.g., Microsoft Entra ID / Azure AD, Okta, Ping Identity) using SAML 2.0 and OIDC protocols.
• Identity Provisioning Service (IPS): Design and configure IPS source/target connectors, JSON transformation scripts, schema mappings, and automated synchronization jobs across on-premise and cloud target systems.
• Identity Lifecycle & Attributes: Manage end-to-end identity lifecycle events, Name ID mapping, SCIM APIs, and user attribute transformations between corporate directories and SAP applications."

D. Stakeholder Engagement, Delivery & Advisory:

• Advisory & Workshops: Lead client discovery workshops, design-thinking sessions, and security walkthroughs with business process owners, functional leads, and Basis/Infrastructure teams.
• Project Deliverables Management: Formulate Deliverable Expectation Documents (DED), functional/technical specifications, security test strategies, and remediation roadmaps.
• Audit Coordination: Collaborate with external and internal audit stakeholders to validate least-privilege configurations, privileged access controls, and remediation evidence."

Skill Requirements

Core Experience: 4-5 years of dedicated, hands-on experience in SAP Security, Authorizations, and Access Governance.

Greenfield Lifecycle Experience: Demonstrated track record of playing a lead role in at least two (2) full lifecycle greenfield implementations of SAP S/4HANA (preferably Private Cloud Edition / RISE with SAP).

S/4HANA Private Cloud Expertise: In-depth expertise in S/4HANA role architecture, PFCG maintenance, user administration, SU24 authorization defaults, and transport mechanics in cloud-hosted environments."

SAP Fiori Security Proficiency: Extensive hands-on experience building custom Fiori Business Catalogs, Groups, Spaces, Pages, and managing OData/ICF service authorizations and Fiori Launchpad Content Manager.

SAP Access Control (GRC v12.0) / IAG: Proven expertise in end-to-end configuration and deployment of GRC 12.0 modules: ARA (custom rule-sets), ARM (MSMP & BRFplus), EAM (Firefighter ID/Role), and BRM."

SAP Cloud Identity Services (IAS & IPS): Hands-on experience in configuring SAP IAS (SAML 2.0 / OIDC federation, authentication policies) and SAP IPS (JSON transformation logic, system connectors, and automated sync jobs).

Diagnostic & Security Tooling: Mastery of security troubleshooting tools and transactions, including ST01, STAUTHTRACE, SU53, SU25, USMM, and Security Audit Log (SM19/SM20).

Other Requirements