Senior SAP Security, BTP & GRC Consultant

Position Overview

We are seeking a senior-level SAP Security, BTP & GRC Consultant to architect and

build our cloud identity landscape from scratch. Currently, Mitek operates without an

active IAM, IPS, or centralized role governance framework in our cloud environments.

The successful candidate will lead the greenfield implementation of SAP Cloud Identity

Services (IAS/IPS), establish unified Role Governance, and seamlessly integrate our

expanding SAP BTP landscape with our existing SAP GRC / SAP IAG infrastructure.

This role requires a hands-on technical engineer who can design modern cloud security

architectures while ensuring strict Segregation of Duties (SoD) and compliance

enforcement across hybrid systems.

Key Responsibilities Greenfield BTP Identity & Access Management (IAM)

• IdP Federation: Architect and implement the connection between our corporate

Identity Provider (e.g., Azure AD/Entra ID, Okta) and SAP Identity

Authentication Service (IAS) to enable Single Sign-On (SSO).

• Automated Lifecycle Provisioning: Configure and deploy SAP Identity

Provisioning Service (IPS) from scratch, establishing source and target system

architectures to automate user creation, modification, and deletion.

• Complex Data Transformation: Write, test, and maintain custom JSON

transformation mapping rules in SAP IPS to filter and translate corporate user

groups seamlessly into BTP target environments.

• Authentication Policies: Enforce risk-based and conditional authentication

policies within IAS, mandating multi-factor authentication (MFA) and

passwordless policies for privileged administrative users.

Cloud Role Governance & GRC Integration

• Role Collection Engineering: Design, build, and optimize structured BTP Role

Collections within the BTP Cockpit across Cloud Foundry, Kyma, or Neo

runtimes, eliminating manual, ad-hoc user assignments.

• GRC / IAG Integration: Extend Mitek's existing SAP GRC Access Control

(ARA, ARM, BRM) or SAP IAG rulebooks to incorporate SAP BTP subaccounts,

enabling end-to-end cloud compliance.

• SoD Enforcement: Map cloud roles against our global compliance matrix to run

pro-active Segregation of Duties (SoD) risk analysis, defining mitigation

controls for multi-system, hybrid-cloud business tasks.

• Compliant Workflows: Build automated access request pipelines where user

approvals flow through SAP GRC, automatically triggering provisioning via SAP

IPS upon validation.

Secure Hybrid Landscape Operations

• Secure Connectivity & Propagation: Collaborate with network teams to secure

user transit between BTP, corporate IdPs, and core backend databases via SAP

Cloud Connector, configuring secure principal propagation.

• Audit Logging & Continuous Monitoring: Centralize platform security logs by

integrating SAP BTP Audit Log Service with our security operations center

(SOC/SIEM) for early threat detection.

• Audit Readiness: Serve as the technical security lead during internal and

external IT audits, defending cloud configurations and extracting necessary

access compliance evidence.

Required Skills & Qualifications Technical Expertise

• Experience: 7+ years of hands-on experience in SAP Security, with at least 3+

years focused exclusively on SAP BTP Security (IAS, IPS) and its integration

with SAP GRC/IAG.

• Identity & Directory Architecture: Deep technical understanding of SAML 2.0,

OAuth 2.0, OpenID Connect (OIDC), JWT tokens, and SCIM APIs for user

identity management.

• System Automation: Mastery over SAP IPS configuration, including advanced

JSON mapping syntax, API endpoints, and handling delta sync loops.

• Core SAP Ecosystem: Demonstrated proficiency in traditional SAP ABAP and

HANA authorization models (S/4HANA, ECC, SAP HANA DB).

Soft Skills & Methodology

• Greenfield Leadership: Proven track record of taking an organization from

"zero" cloud identity configuration to a mature, automated, fully governed

infrastructure.

• Communication & Documentation: Ability to translate complex cloud identity

concepts into easy-to-read blueprints for business stakeholders and technical

teams alike.

Preferred Certifications

• SAP Certified Associate - SAP BTP Security

• SAP Certified Associate - SAP Access Control / SAP Identity Access

Governance