About The Role
We are seeking a highly experienced Senior SAP IAG & Security Consultant to administer, enhance, and support SAP Identity Access Governance (IAG) and the broader SAP security landscape. This role combines hands-on platform administration, access governance, role design, segregation-of-duties analysis, compliance remediation, and participation in SAP IAG implementation and role redesign initiatives.
The ideal professional is a senior, dependable consultant who can work independently in a distributed environment, communicate clearly with technical and business stakeholders, and take full ownership of commitments, risks, documentation, and delivery quality.
Key Responsibilities
Administer and support SAP IAG as a SaaS platform, ensuring stable operation and effective use of its governance capabilities.
Manage SAP IAG modules and processes, including Access Analysis, Access Request, Access Certification, Privileged Access Management (PAM), Business Roles, and mitigation controls.
Perform segregation-of-duties (SoD) analysis, investigate conflicts, recommend remediation or mitigating controls, and monitor risks through closure.
Review access-risk assessment reports and formalize clear, actionable remediation plans aligned with IT general controls (ITGC), audit, and compliance requirements.
Design, build, test, implement, and maintain SAP security roles, profiles, authorizations, and business-role models across SAP environments.
Support role redesign and role-refactoring initiatives using role-based access control (RBAC) principles and least-privilege standards.
Manage user-access lifecycle processes, including provisioning, de-provisioning, transfers, approvals, role assignment, access reviews, and periodic certification.
Develop and enforce SAP security standards, policies, procedures, and control frameworks aligned with business processes and regulatory requirements.
Provide recommendations for the remediation of SoD conflicts, ITGC findings, excessive access, privileged-access risks, and control gaps.
Participate in SAP IAG implementation, enhancement, integration, testing, cutover, hypercare, and continuous-improvement activities.
Work with SAP BTP, Identity Authentication Service (IAS), Identity Provisioning Service (IPS), and connected on-premises and cloud applications.
Partner with SAP Basis, functional, HR, audit, compliance, cybersecurity, application, and business teams to translate requirements into secure and practical solutions.
Create and maintain work instructions, standard operating procedures, technical and functional specifications, control evidence, and other SAP Security/ITGC documentation.
Troubleshoot access, authorization, workflow, connector, provisioning, and integration issues, performing root-cause analysis and driving issues to resolution.
Support general SAP Basis and Security activities when required, while maintaining clear scope, priorities, and stakeholder communication.
Required Qualifications
10+ years of relevant experience in IT, with substantial hands-on experience in SAP Security, Identity and Access Management, or Governance, Risk and Compliance.
Professional experience administering or implementing SAP IAG and/or SAP GRC Access Control in complex enterprise environments.
Strong knowledge of access governance, SoD risk analysis, mitigation controls, user access reviews, privileged access, role lifecycle, and compliant provisioning.
Hands-on experience with SAP role and authorization design, maintenance, testing, troubleshooting, and remediation.
Experience with SAP BTP, SAP IAS, SAP IPS, SAP Basis, and SAP ECC; exposure to Employee Central Payroll (ECP) or related HR/payroll security landscapes.
Experience integrating or governing access for SAP cloud applications such as SuccessFactors and Ariba.
Ability to interpret technical risks and control requirements and communicate them clearly to technical and non-technical stakeholders.
Advanced written and spoken English for collaboration in an international environment.
Ability to work effectively with remote, cross-functional teams and to operate independently with limited supervision.
Preferred Experience
End-to-end SAP IAG implementation experience, including architecture, integration, functional design, testing, cutover, and production support.
Experience with SAP GRC Access Control modules such as ARA, ARM, BRM, and EAM, as well as access certification and reconciliation processes.
Knowledge of S/4HANA, SAP Analytics Cloud, Solution Manager, SAP Portal, SRM, BW, or other connected SAP platforms.
Experience with RBAC-based role redesign, ruleset maintenance, custom transaction assessment, and risk-matrix development.
Background supporting internal or external audits, SOX/ITGC controls, compliance evidence, and remediation tracking.
Relevant SAP Security, SAP GRC, IAM, information security, audit, or cloud certifications.
Success Profile
Ownership and reliability: follows through on commitments, meets agreed deadlines, and maintains high-quality deliverables.
Transparency: communicates progress accurately and escalates risks, delays, dependencies, or mistakes early, together with a recovery plan.
Autonomy and judgment: prioritizes effectively, makes sound decisions within scope, and seeks alignment when a decision may affect security, compliance, or delivery.
Collaboration: builds trusted relationships across technical, functional, audit, compliance, and business teams.
Documentation discipline: produces clear, complete, and reusable documentation that supports operations, auditability, and knowledge transfer.
Continuous improvement: identifies opportunities to simplify access processes, strengthen controls, and improve the user and stakeholder experience.