SAP BTP Identity & Access Consultant

C5MI Insight

1d•$120,000 - $150,000

About The Position

The SAP BTP Identity & Access (IAS) Consultant designs, configures, and supports identity and access management for a custom Vendor Portal built on SAP Business Technology Platform (BTP). The consultant ensures external vendors and brokers can sign in securely and reliably, access only authorized data, and connect seamlessly to SAP S/4HANA and integrated applications. As the subject-matter contributor for portal identity and security, the consultant owns authorization design and partners with integration, BASIS, and client security teams to meet program and federal security requirements. The role includes configuring SAP Cloud Identity Services, establishing identity-provider trust, designing role collections and authorization models, enabling secure access to portal applications and S/4HANA, supporting access governance, resolving access incidents, documenting security design, and assisting with testing, go-live, and hypercare. The consultant also participates in quality assurance activities and protects sensitive information in accordance with security policies.

Requirements

Bachelor’s degree in computer science, information systems, cybersecurity, or a related field, or equivalent experience.
At least 5 years of SAP security or identity and access management experience, including hands-on SAP BTP IAS configuration.
Strong knowledge of SAML 2.0, OpenID Connect, OAuth 2.0, and MFA.
Experience with BTP subaccount security, role collections, and trust configuration.
Experience securing S/4HANA connectivity through SAP Cloud Connector, including principal propagation.
Experience supporting external (B2B) user access for partner or supplier portals.
Ability to obtain and maintain an active government clearance; U.S. citizenship is required.

Nice To Haves

Experience with SAP Cloud Identity Access Governance (IAG) or Microsoft Entra ID Governance.
Experience integrating SAP Cloud Identity Services with an enterprise identity provider such as Microsoft Entra ID.
Experience with SAP Build Work Zone and CAP application security (XSUAA).
Experience with S/4HANA role and authorization design (PFCG).
Experience with federal security frameworks such as NIST SP 800-53 or FedRAMP.
SAP BTP or SAP BTP security certification.
Prior federal or DoD program experience.

Responsibilities

Configure and maintain SAP Cloud Identity Services, including Identity Authentication, Identity Provisioning, and Identity Directory, for the Vendor Portal; support user onboarding, self-registration, password policies, and multi-factor authentication.
Establish trust between BTP subaccounts, SAP Identity Authentication Service (IAS), and the client’s corporate identity provider using SAML 2.0 and OpenID Connect.
Design and maintain role collections, user groups, and authorization models to ensure vendors see only their own authorized data.
Configure secure access to SAP Build Work Zone and SAP Cloud Application Programming Model (CAP) applications that make up the portal.
Enable principal propagation and secure connectivity from BTP to SAP S/4HANA Retail 2025 through SAP Cloud Connector.
Support connected applications from a BTP security standpoint, where supported.
Automate user and role provisioning with SAP Identity Provisioning Service.
Support access governance, including access requests, approvals, periodic access reviews, and segregation-of-duties checks.
Monitor sign-in issues and audit logs, and resolve access incidents promptly.
Document the security design, run test cycles including negative and role-based testing, and support go-live and hypercare.
Partner with integration developers, BASIS, and client security teams to meet program and federal security requirements.
Participate in quality assurance activities and protect sensitive information in accordance with security policies.