SAP Security Engineer (Remote)

About the role

CACI is hiring a full-time SAP Security Engineer to join a cybersecurity and SAP engineering team supporting a DoD IL5-accredited SAP S/4HANA enterprise environment. The engineer helps shape a modern Zero Trust architecture, strengthens system security and contributes to mission-critical readiness. The role is remote, requires a minimum Secret clearance, and involves up to 10% local travel, including a quarterly trip to Scott Air Force Base.

Key responsibilities

• Support SAP security across an IL5 S/4HANA enterprise with integrated security modules and Zero Trust design principles.
• Develop, maintain and optimize SAP authorization objects, composite roles and profile management.
• Enforce SoD and run access reviews via SAP GRC Access Control.
• Integrate SAP Enterprise Threat Detection (ETD) with SIEM platforms such as Splunk using LEEF syslog.
• Implement and support SAP HANA encryption (AES-256 at rest) using PKCS#11 external key management with CloudHSM.
• Manage SAP ILM processes and contribute to data governance initiatives.
• Apply SAP ABAC using BUKRS, KOSTL, PRCTR, WERKS, PERNR, ORGEH and support SAML 2.0 SSO integrations with providers such as Okta.
• Ensure secure interface communication using RFC/3300, HTTPS/8000 and related protocols.
• Contribute to RMF/ATO documentation, eMASS updates, DISA STIG implementations and CORA evidence preparation.
• Support role governance workflows and ISSM approval processes.

Required profile

• Interim Secret clearance (minimum).
• 5+ years of SAP Basis/Security experience with S/4HANA.
• DoD 8140 Foundational 461 (Systems Security Analyst, intermediate or above); one or more of CCSP, Cloud+, GICSP, GISF, GSEC, Security+.
• Preferred: DoD 8140 Residential SAP Security certification.
• Travel to Scott Air Force Base quarterly required.

Required skills

• SAP authorization concepts, composite roles and profile management.
• SAP GRC Access Control, including SoD enforcement and role management.
• SAP ETD and SIEM integration experience.
• SAP HANA encryption and CloudHSM-based IL5 key management.
• SAP ILM, secure SSO integrations, SAP-ABAC attributes and interface hardening.
• RMF/ATO, eMASS, DISA STIG and CORA evidence; NIST 800-171 / 800-53 familiarity.
• Desired: AWS GovCloud IL5, SAP CUA and SAP SNC, CyberArk PAM, hybrid SAP architecture.

What we offer

• Proposed pay range of $75,200-$158,100, depending on location, experience and skills.
• Healthcare, wellness, financial, retirement, family support, continuing education and time-off benefits.
• Flexible time off and learning resources.