SAP Security Consultant: API Authorization (S/4HANA)

About Us:

CodeForce 360 is a trusted global IT talent partner helping Fortune 500 companies, system integrators, and enterprise organizations build high-performing technology teams. With over 16 years of industry expertise, we combine speed, precision, and market intelligence to deliver exceptional talent across today's most in-demand technologies.

 

About the Job- We are looking for an experienced SAP Security Consultant: API Authorization (S/4HANA) to join one of our enterprise client engagements. The ideal candidate should have strong expertise in SAP Ariba APIs, SAP BTP, SAP S/4HANA along with experience working in fast-paced enterprise environments.

 

Job Description

• You will join the security track of a program that gives approved AI assistants governed access to SAP S/4HANA (and later SaaS) data through a library of APIs.
• Every API must give a user no more, and no less, than that user’s SAP authorizations allow.
• You will design, build and prove that for each API, covering record-level access, field-level content and accurate error messages.
• You will work alongside the client’s SAP team, transfer knowledge, then own defined work packages through to integration-test readiness.

 

Responsibilities

• Profile the authorization behaviour of the source SAP transaction using STAUTHTRACE and STUSERTRACE, then compare it with the API’s behaviour for the same user personas.
• Maintain a parity matrix per API, classifying gaps (missing scope check, missing activity check, false deny, field gap, navigation gap, message gap).
• Design and maintain roles and SU22/SU24 data, including start-authorization roles for OData services (S_SERVICE for V2, S_START for V4).
• Author and review CDS access controls (DCL) and RAP authorization logic (authorization master, global and instance checks), and review ABAP AUTHORITY-CHECK logic in custom and wrapped code.
• Define the remedy for standard APIs that do not match UI authorization: role-only fix, facade view with its own access control, RAP wrapper with pre-checks, or recommend not releasing the API.
• Build and run persona-based test suites with negative authorization tests, including filters on unauthorized values, expands into other domains, batch calls and write operations.
• Make sure authorization failures reach the user as explicit errors, never as empty or “not found” results.
• Produce evidence packs (trace exports, parity matrix, test results, SU24 diffs) and security design documents in the client’s templates, with the traceability expected in regulated environments.
• Support security reviews and change management, SoD mapping of services, and knowledge transfer and handover to client and support staff.

 

Required experience

• 5 to 8 years in SAP authorizations and security, with recent hands-on work on S/4HANA 2023 or a comparable release [calibrate to the level you need].
• Strong PFCG, SU22/SU24 and authorization trace skills, and confident analysis of authorization objects across FI, MM and SD.
• Practical API authorization experience:
• OData V2 and V4 start authorizations
• CDS access control (DCL), including inheritance and privileged-access behaviour
• RAP authorization control
• Able to read ABAP and BAPI/FM code well enough to find where authority checks are, or are missing.
• Experience designing positive and negative authorization test cases and presenting evidence to reviewers.
• Clear written documentation and comfort working in agile delivery.

 

Preferred

• Good understanding of SAP BTP security: XSUAA, Cloud Foundry, Cloud Connector, principal propagation (X.509, CERTRULE), Microsoft Entra ID and OAuth.
• Pharmaceutical or life sciences delivery, with familiarity with GxP and validation documentation.
• Exposure to MCP, LLM or agentic AI integration with enterprise systems, and to AI-specific risks such as excessive agency and token misuse.
• ABAP or RAP development exposure, CI/CD, and API test automation (for example Postman or a scripted harness).
• Experience with SAP Ariba APIs or another SaaS API security model.

 

How To Apply

Job ID: JPC - 240371

 

Contact:

Name: Sreekar Konapuram

Email:

Phone:

  

CodeForce 360 proudly provides equal employment opportunities to all employees and applicants and prohibits discrimination and harassment of any kind without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by applicable federal, state, or local laws.