Job Title: SAP Security & GRC Consultant: API Authorization (S/4HANA)
Location: Indianapolis, IN (Hybrid)
Employement Type: W2 Contract
Remote: No
3 days per week Onsite
Must be Local
Role Summary:
You will join the security track of a program that gives approved AI assistants governed access to SAP S/4HANA (and later SaaS) data through a library of APIs. Every API must give a user no more, and no less, than that user's SAP authorizations allow. You will design, build and prove that for each API, covering record-level access, field-level content and accurate error messages. You will work alongside the client's SAP team, transfer knowledge, then own defined work packages through to integration-test readiness.
Responsibilities:
Profile the authorization behaviour of the source SAP transaction using STAUTHTRACE and STUSERTRACE, then compare it with the API's behaviour for the same user personas.
Maintain a parity matrix per API, classifying gaps (missing scope check, missing activity check, false deny, field gap, navigation gap, message gap).
Design and maintain roles and SU22/SU24 data, including start-authorization roles for OData services (S_SERVICE for V2, S_START for V4).
Author and review CDS access controls (DCL) and RAP authorization logic (authorization master, global and instance checks), and review ABAP AUTHORITY-CHECK logic in custom and wrapped code.
Define the remedy for standard APIs that do not match UI authorization: role-only fix, facade view with its own access control, RAP wrapper with pre-checks, or recommend not releasing the API.
Build and run persona-based test suites with negative authorization tests, including filters on unauthorized values, expands into other domains, batch calls and write operations.
Make sure authorization failures reach the user as explicit errors, never as empty or "not found" results.
Produce evidence packs (trace exports, parity matrix, test results, SU24 diffs) and security design documents in the client's templates, with the traceability expected in regulated environments.
Support security reviews and change management, SoD mapping of services, and knowledge transfer and handover to client and support staff.
Required Experience:
5 to 8 years in SAP authorizations and security, with recent hands-on work on S/4HANA 2023 or a comparable release.
Strong PFCG, SU22/SU24 and authorization trace skills, and confident analysis of authorization objects across FI, MM and SD.
Practical API authorization experience:
OData V2 and V4 start authorizations
CDS access control (DCL), including inheritance and privileged-access behaviour
RAP authorization control
Able to read ABAP and BAPI/FM code well enough to find where authority checks are, or are missing.
Experience designing positive and negative authorization test cases and presenting evidence to reviewers.
Clear written documentation and comfort working in agile delivery.
Preferred:
Good understanding of SAP BTP security: XSUAA, Cloud Foundry, Cloud Connector, principal propagation (X.509, CERTRULE), Microsoft Entra ID and OAuth.
Pharmaceutical or life sciences delivery, with familiarity with GxP and validation documentation.
Exposure to MCP, LLM or agentic AI integration with enterprise systems, and to AI-specific risks such as excessive agency and token misuse.
ABAP or RAP development exposure, CI/CD, and API test automation (for example Postman or a scripted harness).
Experience with SAP Ariba APIs or another SaaS API security model.
