PURPOSE
The SAP DevSecOps Lead embeds security, compliance, and governance into the design, build, testing, deployment, and operation of Builders FirstSource’s SAP ecosystem. The role serves as the primary security lead for the future-state SAP landscape, enabling secure delivery while protecting business operations and meeting audit and regulatory expectations.
This position partners with SAP Business and Functional teams, Enterprise Architecture, Infrastructure, Identity and Access Management, Cybersecurity, Audit, managed service providers, and business stakeholders. The role provides security leadership across S/4HANA, SAP Business Technology Platform (BTP), SAP Analytics Cloud (SAC), MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected applications.
ESSENTIAL DUTIES AND RESPONSIBILITIES
Hands-On SAP Security Engineering and Environment Build
Design, build, and harden secure SAP environments across S/4HANA, BTP, SAC, MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected systems.
Configure and validate SAP security controls, including secure client settings, role and authorization design, technical user controls, interface security, logging, monitoring, and transport governance.
Perform hands-on security reviews of SAP configuration, custom code, integrations, RFC connections, APIs, batch jobs, background users, and third-party connections to identify and remediate risk.
Translate security architecture requirements into implementable technical controls, build standards, test scripts, technical designs, and operational procedures.
SAP Security Architecture and Role Governance
Engineer SAP roles and authorizations using least privilege, role-based access control, organizational-level restrictions, derived roles, composite roles, position-based access concepts, and sustainable naming standards.
Build, test, troubleshoot, and support SAP security roles, authorization objects, user groups, SU24 updates, Fiori catalogs and groups, BTP roles, SAC security models, and launchpad access.
Execute technical role remediation for Segregation of Duties conflicts, sensitive access, broad authorization values, excessive organizational access, and inherited risk from legacy role designs.
Document role design decisions, security build standards, access patterns, test results, control mappings, and support procedures for long-term operational ownership.
DevSecOps and Secure Delivery
Implement secure-by-design controls within SAP build, transport, release, and CI/CD processes, including automated code scanning, configuration validation, and approval gates where feasible.
Review ABAP, Fiori, BTP extensions, integration flows, APIs, RFCs, OData services, and custom developments for security defects, insecure permissions, data exposure, and control gaps.
Configure and operate technical traceability between requirements, code or configuration changes, security testing, approval evidence, transports, defects, and production deployment.
Hands-on troubleshooting of SAP access failures, authorization traces, role conflicts, transport issues, security defects, production incidents, and emergency access activities.
Identity, Access, and Privileged Access Management
Configure and support SAP access lifecycle processes, including user provisioning, role assignment, access requests, approvals, recertification, joiner-mover-leaver controls, and periodic access reviews.
Implement and integrate SAP GRC, CPGRC Access Provisioning, SAP IAG, Microsoft Entra ID, privileged access management, SIEM, and enterprise IAM capabilities with SAP platforms.
Build and operate FireCall or emergency access controls, including role setup, approval workflows, session logging, usage review, exception handling, and evidence retention.
Secure service, system, interface, batch, firefighter, and other privileged or non-human accounts through appropriate authentication, ownership, vaulting, monitoring, periodic review, and least-privilege restrictions.
Vulnerability, Threat,…