SAP Security Engineer

CACI International Inc is seeking a SAP Security Engineer to support a DoD IL5-accredited SAP S/4HANA enterprise environment. The role focuses on SAP authorization and access governance, Zero Trust security, encryption, threat detection, secure integrations, and compliance activities including RMF/ATO, DISA STIGs, and audit readiness.

Responsibilities:

• Support SAP security across an IL5 S/4HANA enterprise with integrated security modules and Zero Trust design principles
• Develop, maintain, and optimize SAP authorization objects, composite roles, and profile management
• Execute SoD enforcement and access reviews through SAP GRC Access Control
• Integrate SAP Enterprise Threat Detection (ETD) with SIEM platforms such as Splunk using LEEF syslog
• Implement and support SAP HANA encryption (AES‑256 at rest) using PKCS#11 external key management with CloudHSM
• Manage SAP ILM processes and contribute to data governance initiatives
• Apply SAP attribute‑based access control using BUKRS, KOSTL, PRCTR, WERKS, PERNR, ORGEH
• Support SAP SSO (SAML 2.0) integrations with enterprise identity providers, including Okta
• Ensure secure interface communication using RFC/3300, HTTPS/8000, and related protocols
• Contribute to RMF/ATO documentation, eMASS updates, DISA STIG implementations, and CORA evidence preparation
• Support role governance workflows and ISSM approval processes

Requirements:

• Interim Secret (minimum)
• 5+ years of SAP Basis/Security experience with S/4HANA
• DoD 8140 – Foundational – 461 (Systems Security Analyst – Intermediate or above) CCSP, Cloud+, GICSP, GISF, GSEC, Security+ (one or more)
• Strong proficiency with SAP authorization concepts, composite roles, and profile management
• Hands‑on SAP GRC Access Control experience, including SoD enforcement and role management
• Experience working with SAP ETD and SIEM integrations
• Knowledge of SAP HANA encryption and CloudHSM‑based IL5 key management
• Understanding of SAP ILM, secure data lifecycle management, and governance frameworks
• Familiarity with SAP‑ABAC attributes and secure SSO integrations
• Understanding of SAP protocol security and interface hardening
• RMF/ATO processes and eMASS documentation
• DISA STIG application for SAP environments
• CORA evidence development and audit readiness
• Familiarity with NIST 800‑171 / 800‑53 controls
• Experience managing multi‑step role governance workflows and ISSM gate approvals
• DoD 8140 – Residential SAP Security certification
• Experience with AWS GovCloud IL5 environments
• SAP CUA and SAP SNC configuration skills
• Integration experience with CyberArk PAM for privileged SAP access
• Understanding of hybrid SAP architecture (on‑prem to AWS, including Direct Connect)