{"id":2745097,"url":"https://alion.io/job/builders-firstsource-sap-devsecops-lead-engineer","title":"SAP DevSecOps Lead Engineer","company":{"id":15085,"name":"Builders FirstSource","domain":"bldr.com","url":"https://alion.io/company/bldr","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":{"grade":"B","score":75,"open_postings":112,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":34,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Enterprise Apps","role_family":"Enterprise Apps","seniority":"lead","employment_type":null,"work_mode":"remote","remote_scope":"unspecified","remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ABAP","optional":false},{"name":"CI/CD","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Power BI","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-16T05:00:00Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-17T12:29:11Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"PURPOSE\nThe SAP DevSecOps Lead embeds security, compliance, and governance into the design, build, testing, deployment, and operation of Builders FirstSource’s SAP ecosystem. The role serves as the primary security lead for the future-state SAP landscape, enabling secure delivery while protecting business operations and meeting audit and regulatory expectations.\nThis position partners with SAP Business and Functional teams, Enterprise Architecture, Infrastructure, Identity and Access Management, Cybersecurity, Audit, managed service providers, and business stakeholders. The role provides security leadership across S/4HANA, SAP Business Technology Platform (BTP), SAP Analytics Cloud (SAC), MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected applications.\nESSENTIAL DUTIES AND RESPONSIBILITIES\nHands-On SAP Security Engineering and Environment Build\nDesign, build, and harden secure SAP environments across S/4HANA, BTP, SAC, MDG, IBP, BWZ, Solution Manager, SAP RISE, and connected systems.\nConfigure and validate SAP security controls, including secure client settings, role and authorization design, technical user controls, interface security, logging, monitoring, and transport governance.\nPerform hands-on security reviews of SAP configuration, custom code, integrations, RFC connections, APIs, batch jobs, background users, and third-party connections to identify and remediate risk.\nTranslate security architecture requirements into implementable technical controls, build standards, test scripts, technical designs, and operational procedures.\nSAP Security Architecture and Role Governance\nEngineer SAP roles and authorizations using least privilege, role-based access control, organizational-level restrictions, derived roles, composite roles, position-based access concepts, and sustainable naming standards.\nBuild, test, troubleshoot, and support SAP security roles, authorization objects, user groups, SU24 updates, Fiori catalogs and groups, BTP roles, SAC security models, and launchpad access.\nExecute technical role remediation for Segregation of Duties conflicts, sensitive access, broad authorization values, excessive organizational access, and inherited risk from legacy role designs.\nDocument role design decisions, security build standards, access patterns, test results, control mappings, and support procedures for long-term operational ownership.\nDevSecOps and Secure Delivery\nImplement secure-by-design controls within SAP build, transport, release, and CI/CD processes, including automated code scanning, configuration validation, and approval gates where feasible.\nReview ABAP, Fiori, BTP extensions, integration flows, APIs, RFCs, OData services, and custom developments for security defects, insecure permissions, data exposure, and control gaps.\nConfigure and operate technical traceability between requirements, code or configuration changes, security testing, approval evidence, transports, defects, and production deployment.\nHands-on troubleshooting of SAP access failures, authorization traces, role conflicts, transport issues, security defects, production incidents, and emergency access activities.\nIdentity, Access, and Privileged Access Management\nConfigure and support SAP access lifecycle processes, including user provisioning, role assignment, access requests, approvals, recertification, joiner-mover-leaver controls, and periodic access reviews.\nImplement and integrate SAP GRC, CPGRC Access Provisioning, SAP IAG, Microsoft Entra ID, privileged access management, SIEM, and enterprise IAM capabilities with SAP platforms.\nBuild and operate FireCall or emergency access controls, including role setup, approval workflows, session logging, usage review, exception handling, and evidence retention.\nSecure service, system, interface, batch, firefighter, and other privileged or non-human accounts through appropriate authentication, ownership, vaulting, monitoring, periodic review, and least-privilege restrictions.\nVulnerability, Threat, and Monitoring Management\nConfigure and operate SAP vulnerability management, security monitoring, alerting, log review, and remediation processes across application, platform, cloud, and integration layers.\nUse SAP-focused security tools such as SecurityBridge, Onapsis, SAP Code Vulnerability Analyzer, and native SAP security reporting to identify vulnerabilities, misconfigurations, insecure code, and high-risk access patterns.\nAnalyze SAP security advisories, patches, notes, vulnerabilities, and threat intelligence; coordinate testing, risk acceptance, remediation, and closure tracking with technical teams.\nBuild operational dashboards, technical metrics, control health reporting, vulnerability aging reports, remediation plans, and evidence packages for security, audit, and leadership review.\nSAP RISE, Cloud, Compliance, and Audit\nApply SAP RISE and cloud shared-responsibility controls by validating SAP, hyperscaler, managed service provider, and internal BFS security ownership across environments.\nPrepare and validate technical audit evidence for SAP access, change management, privileged access, vulnerability remediation, logging, monitoring, and control execution.\nDesign and validate secure integration patterns for SAP cloud services, connected applications, APIs, identity providers, monitoring tools, and enterprise security platforms.\nInvestigate SAP security incidents, access issues, control failures, misconfigurations, and high-risk vulnerabilities; perform root-cause analysis and implement corrective actions.\nSUPERVISORY RESPONSIBILITIES\nThis position may provide technical leadership, work direction, coaching, and oversight for internal employees, contractors, system integrators, and managed service providers. Formal people-management responsibilities will depend on the approved organizational design.\nMINIMUM REQUIREMENTS\nBachelor’s degree from an accredited college or university, or an equivalent combination of education, experience, and certifications.\n5+ years of relevant experience in SAP Security, SAP GRC, cybersecurity, identity and access management, security architecture, or SAP platform delivery.\nExperience supporting a large SAP transformation or implementation, preferably including S/4HANA and SAP cloud services.\nDemonstrated knowledge of SAP authorization concepts, role design, organizational restrictions, Segregation of Duties, emergency access, and privileged access.\nWorking knowledge of SAP change, transport, release, testing, and production support processes.\nWorking knowldege MicroSoft PowerBI\nAbility to translate technical security risk into clear business impact, decisions, and actions for executive and program leadership.\nPREFERRED EXPERIENCE AND CERTIFICATIONS\nHands-on experience with SAP RISE, BTP, CPGRC Access Provisioning, SAP IAG, Fiori, SAC, MDG, IBP, BW or BWZ, and Solution Manager.\nExperience with SAP security monitoring, vulnerability assessment, or code scanning tools such as SecurityBridge, Onapsis, or SAP Code Vulnerability Analyzer.\nExperience integrating SAP with Microsoft Entra ID, enterprise IAM, PAM, SIEM, vulnerability management, and CI/CD toolchains.\nCISSP, CISM, CCSP, SAP security or technology certifications, cloud security certifications, or recognized DevSecOps credentials.\nCORE COMPETENCIES\nSAP security architecture and governance\nMicroSoft PowerBI\nSecure delivery and DevSecOps leadership\nRisk-based decision making and control design\nExecutive communication and stakeholder influence\nCross-functional collaboration and vendor leadership\nBias for action, accountability, continuous improvement, and customer focus\nSUCCESS MEASURES\nEstablish a sustainable SAP DevSecOps operating model for ongoing SAP delivery and operations\nEmbed repeatable security controls into design, development, testing, transport, release, and production-support processes.\nImprove SAP access governance, privileged access, vulnerability management, monitoring, and audit readiness.\nReduce avoidable security risk and reliance on reactive remediation while enabling timely program delivery.\nBuild durable internal SAP security capability and effective governance of partners and managed service providers.\nWORK ENVIRONMENT / PHYSICAL ACTIVITY\nThe physical demands described here are representative of those that must be met by an employee to perform the essential functions of the job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\nSubject to typical office environments and occasional outside locations with temperature and weather variations.\nMust be able to lift and carry up to 25 pounds.\nOccasional travel may be required.","description_format":"text","description_chars":8683,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["DevSecOps","Wholesale","Building Materials"],"lifecycle":[{"event":"open","at":"2026-10-16T22:13:55Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":1,"green_card_filings_12m":0,"median_offered_wage_usd":77500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":1,"expected_fill_days":34,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/builders-firstsource-sap-devsecops-lead-engineer","json_url":"https://alion.io/job/builders-firstsource-sap-devsecops-lead-engineer.json","meta":{"generated_at":"2026-10-17T13:58:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18792,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":15085},"rest":"https://alion.io/mcp/rest/get_company?id=15085"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fbuilders-firstsource-sap-devsecops-lead-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fbuilders-firstsource-sap-devsecops-lead-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fbuilders-firstsource-sap-devsecops-lead-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/builders-firstsource-sap-devsecops-lead-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fbuilders-firstsource-sap-devsecops-lead-engineer"}]}