SAP Security Consultant- Contractor

Job Details and ResponsibilitiesSummary:
This is a consultant run-and-operate role within an SAP Security managed services team, not a project delivery role. You will be the most experienced security practitioner covering the Americas time zone — the person tickets escalate to when nobody else can resolve them, and the person clients ask for when something has gone wrong.
You will spend most of your time inside live client landscapes: resolving complex authorisation incidents, designing and assessing security changes against production risk, and holding the line on design integrity when commercial pressure pushes towards quick fixes. You will also be the security voice in client service reviews and the person who fronts audit questions.
Responsibilities:
Service delivery:Acting as the escalation point for SAP Security incidents and service requests across a portfolio of managed services clientsResolving complex authorisation failures through trace analysis (STAUTHTRACE, SU53, SUIM) where L1 and L2 have exhausted their runbooksAssessing, designing and implementing role changes raised as change requests, including impact analysis against live user populationsOwning problem management for recurring security issues — root cause analysis, permanent fix, and closing the loop back into runbooks - ability to work alone and be self-motivated is essentialWorking to defined SLAs for response and resolution, with accurate ticket hygiene in ServiceNow or equivalent
Security operations:Administering SAP BTP security in a BAU context — Identity Authentication Service (IAS), Identity Provisioning Service (IPS), XSUAA, role collections, and subaccount entitlement management across client subaccountsRunning and reviewing SAP GRC Access Control processes: Access Request Management, Emergency Access Management firefighter log review, Access Risk AnalysisSupporting periodic user access recertification campaigns end to endMonitoring and remediating SoD conflicts as business-as-usual, not as a one-off exerciseReviewing and applying security-relevant SAP notes and advising clients on patching priority
Client and governance:Representing security in monthly client service reviews, including trend analysis and improvement recommendationsProducing audit evidence and responding directly to internal and external auditor queriesAdvising client stakeholders — often non-technical — on risk, design trade-offs and remediation optionsContributing to continual service improvement: automation, runbook quality, and reducing repeat ticket volume
Team:Mentoring less experienced consultants and reviewing their role changes before productionWriting and maintaining knowledge articles and runbooks
QualificationsExperience:Minimum 10 years in SAP Security and AuthorisationsSubstantial managed services or application support experience — you have worked to SLAs, in ticket queues, on live production systems, and you understand why that discipline differs from project workDemonstrable, current SAP BTP security experience — specifically IAS, IPS and XSUAA / role collection design and administration. Be specific in your application about what you have built and what you support.Deep S/4HANA and ECC role design: derived roles, composite roles, and organisational level management at scaleStrong Fiori authorisation experience end to end — catalogues, groups, spaces and pages, and the tile-to-authorisation chainHands-on SAP GRC Access ControlSoD analysis, remediation and ongoing monitoring, including direct engagement with auditorsComfortable working autonomously across multiple client accounts with minimal supervisionBased in Latin America with the right to work and invoice as an independent contractorProfessional working proficiency in English
Desirable:
ITIL foundation or equivalent service management groundingSAP Identity Management (IdM) or a third-party IGA tool (SailPoint, Saviynt)Cloud Identity Access Governance (IAG)HANA database security and analytic privilegesSuccessFactors, Ariba or Concur security modelsRead-only ABAP debugging for authorisation troubleshootingRegulated industry exposure — pharmaceutical, financial services, energyScripting or automation experience applied to security operationsRelevant SAP certifications
Selected applicant will be subject to a background investigation, which will be conducted and the results of which will be used in compliance with applicable law.
Lemongrass Consulting is an Equal Opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, religious creed, sex, gender, sexual orientation, gender identity, gender expression, age, genetic information, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.
About LemongrassLemongrass is a global SAP-focused Cloud services provider helping some of the world’s most recognized Enterprises modernize and transform their SAP environments. We combine deep technical expertise with automation, innovation, and AI to deliver meaningful business outcomes.
Our work spans SAP Cloud migrations, managed services, SAP Business Technology Platform (BTP), Business Data Cloud (BDC), and AI-enabled solutions. We help customers build clean core strategies, intelligent data foundations, and scalable Cloud operations across AWS, Microsoft Azure, Google Cloud Platform, and SAP Cloud ERP.
Founded in 2010, Lemongrass has grown into a trusted partner to SAP, AWS, Microsoft, and Google, earning top-tier partner designations along the way including SAP Gold Partner, Premier AWS Partner, Microsoft Gold Partner, and Google Cloud Partner. Our teams operate across the Americas, EMEA, and APAC, collaborating to solve complex challenges for global Enterprises.
At Lemongrass, you’ll work alongside Cloud architects, engineers, and innovators who are shaping the future of SAP in the Cloud—within a culture that values ownership, curiosity, collaboration, and continuous growth.