SAP Security Architect Manager (m/f/d)

SAP Security Architect Manager (m/f/d)

Miejsce pracy: Warszawa

Technologies we use

Expected

• SAP

About the project

In this role, you will be designing and maintaining access model and governance related business processes based on information from stakeholders and identified needs. You will design and implement controls, manage partners/vendors, ensure stakeholders’ satisfaction, and promote an information security culture driven by risk considerations.

We are seeking an SAP Business Technology Platform (BTP) Manager with deep specialization in Security, Identity Management, and Access Governance to join our Identity and Access Governance team. The ideal candidate will be responsible for defining, implementing, and maintaining secure access models across our SAP BTP (mainly) and rest of SAP cloud landscapes, ensuring alignment with corporate compliance and SAP best practices.

You will collaborate closely with SAP Basis, IT Security, Functional (BTS) and Internal Controls teams to establish governance frameworks, role-based permissions, and integrations with SAP Cloud Identity Services.

Your responsibilities

• BTP Security Architecture & Strategy:
• Design and maintain the BTP security architecture, including subaccount structure, trust configuration, and connectivity to Identity Providers (IdPs)
• Define and document security standards and governance models for multi-tenant SAP cloud environments
• Implement and optimize Identity Authentication (IAS) and Identity Provisioning (IPS) services
• Access & Role Management:
• Design and maintain a sustainable BTP to facilitate maintenance of authorizations in the JTI SAP BTP landscape. (develop and maintain role-based access control (RBAC) and attribute-based access control (ABAC) model)
• Act as interface between the different stakeholders (Business, IT, Compliance/Legal teams) to ensure alignment on the access design and the implementation plan
• Manage SAP Cloud security parameters and access, including administrators, developers, and integration users
• Coordinate with compliance teams to ensure adherence to SoD (Segregation of Duties) principles.
• Look for improvement opportunities via automation of internal processes or leveraging existing system functionality
• Manage and transfer knowledge by designing training materials, training SAP security staff and other stakeholders
• Support integration with Identity and Access Management solutions (Identity IIQ/SailPoint preferred)
• Governance & Compliance:
• Define and implement SAP cloud security and Access Governance policies, procedures, and standards in alignment with enterprise IT security frameworks
• Design and implement new controls ensuring SAP BTP and cloud systems remain available, transactional integrity is guaranteed, data sensitivity and confidentiality requirements are met, and risks are considered
• Support audit activities by providing documentation, logs, and risk assessments
• Implement security monitoring and reporting using Security Bridge, SAP Cloud ALM, Audit Logs, and Security Analytics tools
• Integration & Automation:
• Integrate SAP BTP with SAP Identity Access Governance (IAG), SAP Cloud Identity, and on-premises SAP systems (S/4HANA, BW/4HANA, etc.)
• Automate user lifecycle management and access provisioning through APIs and scripting
• Collaborate with DevOps teams to embed security into CI/CD pipelines
• Advisory & Enablement:
• Provide expert advice on BTP security topics to project teams and business stakeholders
• Deliver training sessions and internal knowledge transfer on BTP access management

Our requirements

• Technical Expertise:
• 5+ years of experience in SAP Security and Identity Management
• 3+ years hands-on experience with SAP BTP (Neo & Cloud Foundry environments)
• strong understanding of SAP Cloud Identity Services (IAS, IPS) and SAP Identity Access Governance (IAG)
• experience configuring trust relationships, OAuth2, SAML, and XSUAA authorizations
• knowledge of BTP cockpit administration, subaccount hierarchy, and entitlement management
• Preferred Skills:
• Experience integrating SAP BTP with Azure AD or Okta, or Keycloak
• Familiarity with SAP Cloud ALM, Security Monitoring, and Audit Log API
• Exposure to BTP services such as CAP, BAS, Workflow Management, or Integration Suite
• Knowledge SAP GRC Access control or Cybersecurity frameworks (ISO 27001, NIST2,…)
• Soft Skills:
• Strong communication and documentation abilities
• Comfortable leading workshops and security design sessions
• Analytical mindset with a proactive approach to risk management

Benefits

• sharing the costs of sports activities
• private medical care
• sharing the costs of professional training & courses
• life insurance
• remote work opportunities
• flexible working time
• fruits
• integration events
• corporate sports team
• retirement pension plan
• saving & investment scheme
• corporate credit card
• corporate library
• no dress code
• video games at work
• coffee / tea
• drinks
• parking space for employees
• leisure zone
• extra social benefits
• sharing the costs of holidays for kids
• employee referral program
• charity initiatives
• JTI Benefit Platform
• Free beverages, snacks, fruit, sandwiches, and popcorn
• Employee Assistance Program (EAP)
• Employee Share Purchase Plan
• 20 weeks of paid family leave for new parents
• Anniversary Award Program
• Quick Reward Program

JTI GBS POLAND Sp. z o.o.

JTI Poland is part of Japan Tobacco International, a leading international tobacco company. We operate in 130 countries, employ over 45,000 people worldwide and our product portfolio includes world-renowned brands such as Camel, LD, Winston and Logic, available on the Polish market.

In Poland, we employ over 2,300 employees and we are the 3rd player in the tobacco industry. Since the beginning of JTI’s operations in Poland in 2007, we have been the fastest growing tobacco company: our market share has more than quadrupled and our production volume has grown more than 10 times.

But our business, isn’t just business. Our business is our people. Their talent. Their potential. We believe when they’re free to be themselves, grow, travel and develop, amazing things can happen for our business. That’s why since 11 years JTI is one of the Top Employers in Poland, in 2020 being ranked number one for the second year in a row.

If you decide to participate in this recruitment, the administrator of your data will be JTI GBS Poland sp. z o.o. with headquarters in Warsaw. Your data will be processed only to support the recruitment process in which you participate. Detailed information on the processing of your data: Detailed information on the processing of your personal data: 1. Who is the controller of your personal data? Name and registered office: JTI GBS Poland sp. z o.o., ul. Żelazna 51/53, 00-841 Warsaw Contact mailbox regarding data processing: Wyświetl e-mail na pracuj.pl Data Protection Officer: The data controller has appointed a Data Protection Officer who can be contacted directly at the following address: Wyświetl e-mail na pracuj.pl. The Data Protection Officer can be contacted in all matters related to the processing of personal data and the exercise of rights related to the processing of such data. 2. For what purposes is your personal data processed? Your personal data will be processed for the purpose of enabling you to take part in the recruitment process for the position in JTI GBS to which your application relates. If you have provided your consent to participate in the recruitment processes conducted by JTI GBS in the future, your data will also be processed for this purpose. If your application is considered under the employee referral program, your data will also be processed to accomplish the objectives of the program. In specific situations, JTI GBS may also process your personal data to the extent necessary to establish, assert or defend against claims. Detailed information on the basis of data processing is provided in the table. 3. What is the data retention period? The data provided in order to take part in a specific recruitment project will be retained for the period until the end of the recruitment process, up to a maximum of 3 months from the selection of the employee in case no contract has been concluded. If you have given your consent to the processing of your personal data for future recruitments, then your data will be processed until your consent is withdrawn, but for no longer than for 12 months. In case of processing your application under the employee referral program, your personal data will be processed until the objectives of the program have been met. The duration of the processing of your personal data may be extended each time by the period of the statute of limitations for claims, if the processing is necessary to establish, assert or defend against claims. 4. Who will be the recipients of your personal data? The data may be transferred to entities processing personal data on behalf of the controller, e.g. IT service providers, entities operating the database, entities handling application requests – however, these entities process data on the basis of an agreement with the controller and only in accordance with the controller's instructions and within the scope of the granted consent. Personal data may also be transferred to other JTI Group companies in connection with intra-group purposes. 5. Will your personal data be subject to profiling? During the recruitment process, you may be asked to complete tests (e.g. analytical test, behavioural test, cognitive test) or to participate in an Assessment Center session. In the case of behavioural test, you will be subject to profiling. The system will evaluate the answers you give in the survey and create a profile of your behaviour and preferred working conditions based on these answers. The test is only a support material for the recruiter conducting your recruitment process and no automated decisions are made based thereon. 6. What are your rights in relation to the processing of your personal data? You have the right to withdraw your consent for processing of data at any time. The withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. You have the right to obtain information about the processing of your personal data concerned in accordance with Art. 15 of the GDPR, including to obtain copies of your personal data. In addition, you may request the rectification of inaccurate personal data, as well as the completion of incomplete personal data. You may also request restriction of the processing in the cases referred to in Art. 18 of the GDPR, as well as the data portability. You have the right to object to the processing of your personal data. You have also the right to erasure your personal data. . When profiling is used (it may take place when using behavioural tests in the recruitment process), you have the right to object to the profiling of your personal data. In order to exercise the above rights, please contact the data controller, e.g. by sending an appropriate request via e-mail. You also have the right to lodge a complaint with the supervisory authority (Poland: President of the Personal Data Protection Office). 7. Is personal data transferred outside the European Economic Area? Your personal data may be entrusted for processing to JT International S.A. with its registered office in Switzerland, i.e. outside the European Economic Area (EEA). The European Commission has stated that this country offers an adequate level of personal data protection (Commission Decision of 26 July 2000). The recipient has implemented adequate and appropriate safeguards for your personal data. You have the right to receive a copy of the transferred personal data. Your personal data may also be transferred to other JTI Group companies that are based outside the EEA. Whenever the country to which the transfer of personal data will take place does not provide an adequate level of protection for personal data, JTI GBS will ensure the protection of your personal data in accordance with applicable legislation. 8. Is provision of the personal data mandatory? Responding to the Company's advertisement and providing your data is voluntary. However providing the mandatory data is necessary for your application to be considered during the recruitment process. Failure to provide this data will prevent your application from being considered. The provision of other data is voluntary and constitutes the candidate's consent to their processing in the recruitment process. If you raise an objection to the processing of your personal data during the recruitment process, further participation will not be possible.