Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 21 hours ago

SAP DevSecOps Lead Engineer

Builders1,257 open roles

Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSAP DevSecOps Lead EngineerBuilders

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Builders's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

10.3% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.0%1 day
  2. 4.2%3 days
  3. 10.3%7 days
  4. 15.9%14 days
  5. 34.1%30 days
This job: posted 21 hours ago

The posting

PURPOSE

The SAP DevSecOps Lead embeds security, compliance, and governance into the design, build, testing, deployment, and operation of Builders FirstSource’s SAP ecosystem. The role serves as the primary security lead for the future-state SAP landscape, enabling secure delivery while protecting business operations and meeting audit and regulatory expectations.

This position partners with SAP Business and Functional teams, Enterprise Architecture, Infrastructure, Identity and Access Management, Cybersecurity, Audit, managed service providers, and business stakeholders. The role provides security leadership across S/4HANA, SAP Business Technology Platform (BTP), SAP Analytics Cloud (SAC), MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected applications.

ESSENTIAL DUTIES AND RESPONSIBILITIES

Hands-On SAP Security Engineering and Environment Build

Design, build, and harden secure SAP environments across S/4HANA, BTP, SAC, MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected systems.

Configure and validate SAP security controls, including secure client settings, role and authorization design, technical user controls, interface security, logging, monitoring, and transport governance.

Perform hands-on security reviews of SAP configuration, custom code, integrations, RFC connections, APIs, batch jobs, background users, and third-party connections to identify and remediate risk.

Translate security architecture requirements into implementable technical controls, build standards, test scripts, technical designs, and operational procedures.

SAP Security Architecture and Role Governance

Engineer SAP roles and authorizations using least privilege, role-based access control, organizational-level restrictions, derived roles, composite roles, position-based access concepts, and sustainable naming standards.

Build, test, troubleshoot, and support SAP security roles, authorization objects, user groups, SU24 updates, Fiori catalogs and groups, BTP roles, SAC security models, and launchpad access.

Execute technical role remediation for Segregation of Duties conflicts, sensitive access, broad authorization values, excessive organizational access, and inherited risk from legacy role designs.

Document role design decisions, security build standards, access patterns, test results, control mappings, and support procedures for long-term operational ownership.

DevSecOps and Secure Delivery

Implement secure-by-design controls within SAP build, transport, release, and CI/CD processes, including automated code scanning, configuration validation, and approval gates where feasible.

Review ABAP, Fiori, BTP extensions, integration flows, APIs, RFCs, OData services, and custom developments for security defects, insecure permissions, data exposure, and control gaps.

Configure and operate technical traceability between requirements, code or configuration changes, security testing, approval evidence, transports, defects, and production deployment.

Hands-on troubleshooting of SAP access failures, authorization traces, role conflicts, transport issues, security defects, production incidents, and emergency access activities.

Identity, Access, and Privileged Access Management

Configure and support SAP access lifecycle processes, including user provisioning, role assignment, access requests, approvals, recertification, joiner-mover-leaver controls, and periodic access reviews.

Implement and integrate SAP GRC, CPGRC Access Provisioning, SAP IAG, Microsoft Entra ID, privileged access management, SIEM, and enterprise IAM capabilities with SAP platforms.

Build and operate FireCall or emergency access controls, including role setup, approval workflows, session logging, usage review, exception handling, and evidence retention.

Secure service, system, interface, batch, firefighter, and other privileged or non-human accounts through appropriate authentication, ownership, vaulting, monitoring, periodic review, and least-privilege restrictions.

Vulnerability, Threat, and Monitoring Management

Configure and operate SAP vulnerability management, security monitoring, alerting, log review, and remediation processes across application, platform, cloud, and integration layers.

Use SAP-focused security tools such as SecurityBridge, Onapsis, SAP Code Vulnerability Analyzer, and native SAP security reporting to identify vulnerabilities, misconfigurations, insecure code, and high-risk access patterns.

Analyze SAP security advisories, patches, notes, vulnerabilities, and threat intelligence; coordinate testing, risk acceptance, remediation, and closure tracking with technical teams.

Build operational dashboards, technical metrics, control health reporting, vulnerability aging reports, remediation plans, and evidence packages for security, audit, and leadership review.

SAP RISE, Cloud, Compliance, and Audit

Apply SAP RISE and cloud shared-responsibility controls by validating SAP, hyperscaler, managed service provider, and internal BFS security ownership across environments.

Prepare and validate technical audit evidence for SAP access, change management, privileged access, vulnerability remediation, logging, monitoring, and control execution.

Design and validate secure integration patterns for SAP cloud services, connected applications, APIs, identity providers, monitoring tools, and enterprise security platforms.

Investigate SAP security incidents, access issues, control failures, misconfigurations, and high-risk vulnerabilities; perform root-cause analysis and implement corrective actions.

SUPERVISORY RESPONSIBILITIES

This position may provide technical leadership, work direction, coaching, and oversight for internal employees, contractors, system integrators, and managed service providers. Formal people-management responsibilities will depend on the approved organizational design.

MINIMUM REQUIREMENTS

Bachelor’s degree from an accredited college or university, or an equivalent combination of education, experience, and certifications.

5+ years of relevant experience in SAP Security, SAP GRC, cybersecurity, identity and access management, security architecture, or SAP platform delivery.

Experience supporting a large SAP transformation or implementation, preferably including S/4HANA and SAP cloud services.

Demonstrated knowledge of SAP authorization concepts, role design, organizational restrictions, Segregation of Duties, emergency access, and privileged access.

Working knowledge of SAP change, transport, release, testing, and production support processes.

Working knowldege MicroSoft PowerBI

Ability to translate technical security risk into clear business impact, decisions, and actions for executive and program leadership.

PREFERRED EXPERIENCE AND CERTIFICATIONS

Hands-on experience with SAP RISE, BTP, CPGRC Access Provisioning, SAP IAG, Fiori, SAC, MDG, IBP, BW or BWZ, and Solution Manager.

Experience with SAP security monitoring, vulnerability assessment, or code scanning tools such as SecurityBridge, Onapsis, or SAP Code Vulnerability Analyzer.

Experience integrating SAP with Microsoft Entra ID, enterprise IAM, PAM, SIEM, vulnerability management, and CI/CD toolchains.

CISSP, CISM, CCSP, SAP security or technology certifications, cloud security certifications, or recognized DevSecOps credentials.

CORE COMPETENCIES

SAP security architecture and governance

MicroSoft PowerBI

Secure delivery and DevSecOps leadership

Risk-based decision making and control design

Executive communication and stakeholder influence

Cross-functional collaboration and vendor leadership

Bias for action, accountability, continuous improvement, and customer focus

SUCCESS MEASURES

Establish a sustainable SAP DevSecOps operating model for ongoing SAP delivery and operations

Embed repeatable security controls into design, development, testing, transport, release, and production-support processes.

Improve SAP access governance, privileged access, vulnerability management, monitoring, and audit readiness.

Reduce avoidable security risk and reliance on reactive remediation while enabling timely program delivery.

Build durable internal SAP security capability and effective governance of partners and managed service providers.

WORK ENVIRONMENT / PHYSICAL ACTIVITY

The physical demands described here are representative of those that must be met by an employee to perform the essential functions of the job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Subject to typical office environments and occasional outside locations with temperature and weather variations.

Must be able to lift and carry up to 25 pounds.

Occasional travel may be required.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Builders's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Builders's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Builders's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.