Sr. InfoSec Analyst
Core
Senior Information Security Analyst specializing in SAP Application Security, responsible for identifying, assessing, and tracking security vulnerabilities within SAP ABAP custom code and application environments.
Role type
Senior IC application security engineer (SAP)
Builds
Secure SAP ABAP codebases and application environments
Domain
Enterprise software security / SAP ecosystem
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
SAP ABAP programming, SAP application security, secure software development lifecycle (SSDLC), vulnerability management, ServiceNow integration, Onapsis Assess for Code, Onapsis Control for Code, risk-based prioritization, executive reporting, threat modeling, CI/CD integration, DevSecOps, OWASP Top 10 knowledge, SAP authorization concepts, SAP S/4HANA, SAP ECC, SAP BTP
Preferred skills
SAP Certified Associate – SAP System Security and Authorizations, SAP Certified Technology Associate – SAP S/4HANA System Administration, SAP BTP Security, CISSP, CISM
Technologies
Onapsis Assess for Code, Onapsis Control for Code, ServiceNow, SAP S/4HANA, SAP ECC, SAP BTP, CI/CD pipelines
Responsibilities
Perform security assessments of SAP custom code using Onapsis Assess for Code; Identify vulnerabilities, insecure coding patterns, authorization weaknesses, and configuration issues within SAP applications; Analyze ABAP source code for security risks including injection vulnerabilities, authorization bypasses, insecure RFC calls, hardcoded credentials, and data exposure risks; Validate findings and provide remediation guidance to SAP development teams; Support secure software development lifecycle (SSDLC) practices for SAP applications; Establish secure coding standards for SAP ABAP development; Administer and maintain Onapsis Control for Code; Configure automated policy checks and security controls within SAP development workflows; Integrate SAP code security findings into ServiceNow Vulnerability Response; Develop risk-based prioritization methodologies for SAP application vulnerabilities; Develop executive and operational reporting for SAP application security risks; Track remediation progress and risk reduction initiatives; Conduct developer awareness sessions focused on SAP secure coding practices; Collaborate with SAP BASIS, architecture, infrastructure, and cybersecurity teams to reduce application risk; Support threat modeling activities for SAP applications and business-critical processes; Improve SAP application security posture through continuous code assessment; Reduce the number of critical and high-risk SAP code vulnerabilities; Ensure security findings are tracked and managed through ServiceNow; Provide risk-based recommendations and remediation guidance to application owners; Maintain accurate reporting and metrics related to SAP code security
Seniority
Senior, hands-on IC
