SAP BTP Identity & Access Consultant

C5MI is not your typical consulting firm. We are a high-performance team of SAP and supply chain experts who solve complex, mission critical challenges for organizations that cannot afford failure.

We hire consultants who thrive in complexity, move fast, take ownership, and deliver under pressure. At C5MI, you will not be siloed or stuck in theory. You will be hands on, client facing, and directly influencing outcomes that matter.

Our culture rewards initiative, accountability, and continuous growth. This is a place where your expertise is valued, your work is meaningful, and your performance truly matters. If you’re energized by learning through real-world challenges, collaborating with top-tier talent, and expanding your capabilities every day, C5MI is where strong consultants level up.

Position Summary:

The SAP BTP Identity & Access (IAS) Consultant designs, configures, and supports identity and access management for the custom Vendor Portal built on SAP Business Technology Platform (BTP). The consultant ensures that external vendors and brokers sign in securely and reliably, see only the data they are authorized to see, and connect seamlessly to SAP S/4HANA and integrated applications. As the subject-matter contributor for portal identity and security, the consultant owns the authorization design and partners with integration, BASIS, and client security teams to meet program and federal security requirements.

Essential Functions & Responsibilities:

• Configures and maintains SAP Cloud Identity Services (Identity Authentication, Identity Provisioning, and Identity Directory) for the Vendor Portal, including user onboarding, self-registration, password policies, and multi-factor authentication (MFA).
• Establishes trust between BTP subaccounts, SAP Identity Authentication Service (IAS), and the client’s corporate identity provider using SAML 2.0 and OpenID Connect.
• Designs and maintains role collections, user groups, and authorization models so vendors see only their own data, including business partner details, contracts, site groups, article lists, purchase orders, and bill back agreements.
• Configures secure access to the SAP Build Work Zone and SAP Cloud Application Programming Model (CAP) applications that make up the portal.
• Enables principal propagation and secure connectivity from BTP to SAP S/4HANA Retail 2025 through SAP Cloud Connector.
• Supports connected applications from a BTP security standpoint, where supported.
• Automates user and role provisioning with SAP Identity Provisioning Service.
• Supports access governance, including access requests, approvals, periodic access reviews, and segregation-of-duties checks.
• Monitors sign-in issues and audit logs, and resolves access incidents quickly so the portal works consistently for the client.
• Documents the security design, runs test cycles (including negative and role-based testing), and supports go-live and hypercare.
• Partners with integration developers, BASIS, and client security teams to meet program and federal security requirements.
• Adheres to all certified processes as part of our commitment to maintaining the highest standards of quality and information security, which includes actively participating in quality assurance activities and ensuring the protection of sensitive information in accordance with our security policies.

Minimum Requirements:

• Bachelor’s degree in computer science, information systems, cybersecurity, or a related field, or equivalent experience.
• 5+ years of SAP security or identity and access management experience, including hands-on SAP BTP IAS configuration.
• Strong knowledge of SAML 2.0, OpenID Connect, OAuth 2.0, and MFA.
• Experience with BTP subaccount security, role collections, and trust configuration.
• Experience securing S/4HANA connectivity through SAP Cloud Connector, including principal propagation.
• Experience supporting external (B2B) user access for partner or supplier portals.
• Must be able to obtain and maintain an active government clearance (requires U.S. citizenship).

Nice to Have:

• Experience with SAP Cloud Identity Access Governance (IAG) or Microsoft Entra ID Governance.
• Experience integrating SAP Cloud Identity Services with an enterprise identity provider such as Microsoft Entra ID.
• Experience with SAP Build Work Zone and CAP application security (XSUAA).
• Experience with S/4HANA role and authorization design (PFCG).
• Experience with federal security frameworks such as NIST SP 800-53 or FedRAMP.
• SAP BTP or SAP BTP security certification.
• Prior federal or DoD program experience.

Compensation: In accordance with pay transparency law, the expected salary range for this position is $120,000 – $150,000 annually. The actual compensation offered will be determined based on factors such as the candidate’s experience, qualifications, skills, and location. We are committed to fair and equitable compensation practices. This posted range reflects our good faith estimate of the compensation we reasonably expect to offer for this role at the time of posting.

Application Deadline: We anticipate this job posting will be posted until 1/16/2026.

Benefits:

C5MI offers a market competitive suite of benefits including medical, dental, vision, life, and long-term disability coverage, a 401(k) plan, bonus opportunities, paid holidays, and paid time off. See more information on our benefits here: C5MI Benefits

Our employees are key to our success, so we strive to be more than just a team; we’re a community built upon a set of Core Values that guide our every action:

• Challenge – We believe in challenging the present – it’s the only way to shape the future. We must be exceptional communicators and collaborators while always learning. We also understand that speaking your mind requires equal parts brain (what to say), thoughtfulness (when to say it), and caring (how it’s said). Incremental won’t win.
• Have Fun – We are on a journey, together. Take care of your family, take care of yourself, and take care of each other. Live your happiness. Stay human, take care of each other and invest in your community. Life isn’t all about work. Live your happiness. Be healthy.
• All In – You can’t fake passion – show your energy. Own it – take charge and lead. Our team is made up of top quartile talent and we never accept second best. Accountability, trust, and integrity create an environment to realize the team’s true potential.
• Never Forget the Customer – We have walked a mile in your shoes. Experience matters. We drive innovation to generate business value. Be true – no BS.
• GSD (Get Stuff Done) – We take initiative and never make excuses. We act with urgency, and we delivery high quality outcomes with extreme velocity. We embrace process discipline, drive continuous improvement, and stay audit ready. We relentlessly execute and plan for tomorrow by creating sustainable outcomes. That is how we win!
• Empower – Our people are the foundation for our success. We recognize their value, and support them by fostering a culture of collaboration and innovation. We recognize individual strengths, build confidence through action, and invest in personal development.

How to Apply:

To apply for this position, use the application link provided in this job posting and complete the application and submit a resume. If the position requires a specific certification, please be sure to upload a copy of your certification when you apply.

If you would like to be considered for employment opportunities with C5MI and have accommodation needs such as for a disability or religious observance, please call us toll free at View phone number on aiapply.co or send us an email here or speak with your recruiter.

C5MI is an Equal Opportunity Employer that does not discriminate on the basis of actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex or gender (including pregnancy, childbirth, pregnancy-related conditions, and lactation), gender identity or expression (including transgender status), sexual orientation, marital status, military service and veteran status, physical or mental disability, genetic information, or any other characteristic protected by applicable federal, state, or local laws and ordinances.