SAP Security Engineer

Description

You will work on a team of cybersecurity and SAP engineers that secures a SAP S/4HANA enterprise environment accredited to DoD IL5.

You will help design and strengthen a Zero Trust architecture, harden system security, and support readiness for mission-critical work.

The role suits engineers who like hard security problems and working with cyber and audit colleagues to build secure, scalable SAP platforms.

Responsibilities

• Support SAP security across an IL5 S/4HANA system, including its integrated security modules and Zero Trust design principles.
• Build, maintain, and tune SAP authorization objects, composite roles, and profiles.
• Enforce separation of duties and run access reviews in SAP GRC Access Control.
• Connect SAP Enterprise Threat Detection (ETD) to SIEM platforms such as Splunk over LEEF syslog.
• Implement and maintain SAP HANA encryption with AES-256 at rest, using PKCS11 external key management with CloudHSM.
• Run SAP ILM processes and help with data governance work.
• Apply SAP attribute-based access control using BUKRS, KOSTL, PRCTR, WERKS, PERNR, and ORGEH.
• Support SAP SSO over SAML 2.0 with enterprise identity providers, including Okta.
• Secure interface communication over RFC/3300, HTTPS/8000, and related protocols.
• Help prepare RMF/ATO documentation, eMASS updates, DISA STIG implementations, and CORA evidence.
• Support role governance workflows and ISSM approvals.

Requirements

• Required: An Interim Secret clearance at minimum.
• Required: 5+ years of SAP Basis or Security experience with S/4HANA.
• Required: DoD 8140 Foundational certification 461 (Systems Security Analyst at Intermediate or above), or one or more of CCSP, Cloud+, GICSP, GISF, GSEC, or Security+.
• Preferred: DoD 8140 Residential SAP Security certification.
• Required: Strong working knowledge of SAP authorization concepts, composite roles, and profile management.
• Required: Hands-on SAP GRC Access Control work, including separation of duties enforcement and role management.
• Required: Experience with SAP ETD and SIEM integrations.
• Required: Knowledge of SAP HANA encryption and CloudHSM-based key management for IL5.
• Required: Understanding of SAP ILM, secure data lifecycle management, and governance frameworks.
• Required: Familiarity with SAP ABAC attributes and secure SSO integrations.
• Required: Understanding of SAP protocol security and interface hardening.
• Required: Experience with RMF/ATO processes and eMASS documentation.
• Required: Experience applying DISA STIGs to SAP environments.
• Required: Experience developing CORA evidence and preparing for audits.
• Required: Familiarity with NIST 800-171 and 800-53 controls.
• Required: Experience running multi-step role governance workflows and ISSM gate approvals.
• Required: Travel to Scott Air Force Base each quarter.
• Desired: Experience with AWS GovCloud IL5 environments.
• Desired: SAP CUA and SAP SNC configuration skills.
• Desired: Experience integrating CyberArk PAM for privileged SAP access.
• Desired: Understanding of hybrid SAP architecture, from on-premises to AWS, including Direct Connect.

Conditions

Full-time, regular position.

Requires a Secret clearance at minimum to start.

Local travel of up to 10%.

Salary depends on factors such as location, Federal Government contract labor categories and wage rates, relevant experience, specific skills, education, and certifications.

The role can be worked from more than one location, so the stated range is the national average for the position.

The proposed salary range is $75,200-$158,100.

Benefits

• Comprehensive benefits, including healthcare, wellness, financial, retirement, family support, continuing education, and time off.
• Flexible time off that lets you take the time you need.
• Access to learning resources for professional development.