SAP Security Administrator II

This position opens on November 13, 2026, and will remain open until filled. The first review of applications will occur on November 30, 2026.

Eugene Water & Electric Board (EWEB) is seeking an experienced SAP Security Administrator II to lead and execute SAP security operations, access governance, and compliance initiatives across SAP and enterprise business applications. This role is responsible for advanced role design, Segregation of Duties (SoD) analysis, audit support, and optimization of identity and access processes.

The ideal candidate will have hands-on experience with SAP security and SAP Identity Access Governance (IAG) and will play a key role in strengthening access controls, improving governance processes, and supporting a secure and compliant enterprise environment.

Key Responsibilities

Access Governance & Provisioning

• Support the management of end-to-end user access lifecycle across SAP and integrated enterprise applications

• Design, implement, and optimize access request workflows and approval paths within IAG

• Ensure timely and accurate provisioning, modification, and de-provisioning of access in accordance with security policies

• Troubleshoot complex provisioning issues across SAP and connected systems

Role Design & Authorization Management

• Design, build, and maintain SAP roles using best practices (single roles, composite roles, derived roles) in SAP S/4HANA

• Analyze and maintain authorization objects, field values, and role hierarchies to enforce least privilege access

• Partner with business/functional stakeholders to translate functional requirements into secure and scalable role designs

• Continuously improve role design to reduce risk, redundancy, and complexity

Segregation of Duties (SoD) & Risk Management

• Perform advanced SoD analysis, risk identification, and remediation using IAG

• Define and maintain SoD rulesets, risk matrices, and mitigating controls

• Evaluate and approve mitigating controls in collaboration with audit and compliance teams

• Lead remediation efforts to resolve SoD conflicts while maintaining business continuity

Audit & Compliance

• Serve as a primary point of contact for internal and external audits (SOX, ITGC) related to SAP access

• Prepare and deliver audit evidence, including access reviews, role documentation, and control execution artifacts

• Support periodic user access reviews and certifications, ensuring completeness and accuracy

• Identify control gaps and implement corrective actions

Emergency Access & Monitoring

• Administer and monitor Firefighter (emergency access) IDs, ensuring proper usage, logging, review, and approval

• Investigate and resolve inappropriate or high-risk access usage

• Develop reporting and monitoring mechanisms for privileged access

Project Support & Functional Partnership

• Partner closely with SAP functional/technical teams to support security requirements for projects and enhancements

• Participate in project lifecycle activities including design, build, test, and deployment phases

• Translate functional specifications into secure role and authorization designs

• Perform security impact assessments for new implementations, upgrades, and changes.

• Support SAP projects such as migrations, enhancements, and transformations

• Ensure security is integrated into project deliverables, including role design, SoD analysis, and access provisioning

• Assist with testing activities (unit testing, integration testing, UAT) related to roles and authorizations

• Identify and mitigate security risks during project execution

• Collaborate with BASIS and technical teams on transports and system changes impacting security

• Provide guidance to functional teams on best practices for access control and compliance

Enterprise Application Security

• Extend access governance practices to enterprise business applications beyond SAP

• Ensure consistent identity and access controls across integrated systems

• Collaborate with application owners to standardize provisioning and access review processes

Process Improvement & Automation

• Identify opportunities to automate manual access management processes within IAG

• Enhance workflows, notifications, and approval chains to improve efficiency and user experience

• Drive continuous improvement initiatives in access governance and compliance processes

Collaboration & Leadership

• Act as a subject matter expert (SME) for SAP security and access governance

• Mentor junior analysts and provide guidance on best practices

• Collaborate with BASIS, functional/technical teams, and IS security architects to align security strategies

• Participate in security design discussions for new SAP implementations or enhancements

What You’ll Bring

Recommended Qualifications

• Experience with SAP S/4HANA security design and Fiori authorization concepts

• Familiarity with SAP GRC Access Control or other IAM platforms

• Knowledge of integration between SAP and enterprise identity systems

• Experience supporting cloud and hybrid SAP environments

Key Skills

• Advanced User Access Management (UAM)

• SAP Role Design & Authorization Objects

• Segregation of Duties (SoD) Analysis & Remediation

• Identity Access Governance (IAG)

• Audit & Compliance (SOX, ITGC)

• Process Improvement & Automation

• Cross-application access governance

• Stakeholder communication and leadership

Location: This position is based in Eugene, Oregon; it has been approved as a hybrid work arrangement involving a combination of telecommuting and working onsite. The selected candidate must live in the state of Oregon.

Compensation & Benefits

The starting annual salary for this position is $96,523.58 to $120,654.48 commensurate with knowledge, skills, education, and experience as it relates to the position.

The base pay offered will be established based on multiple factors, including job-related knowledge and skills, relevant experience, and internal equity. Consistent with EWEB’s compensation philosophy, it is not customary to place individuals at the high end of the salary range at the time of hire. Compensation decisions are made holistically to support fair, consistent, and equitable pay practices, taking into account the specific circumstances of each position and candidate.

EWEB values total worker health, both at work and at home, and provides a robust compensation & benefits package. - Read more about our benefits.

Qualifications & Requirements

EWEB will consider an equivalent combination of relevant education and experience when reviewing applications. Candidates who do not meet all the minimum qualifications, but whose application materials demonstrate the necessary knowledge, skills, and abilities to be successful in the position, are encouraged to apply. We understand that valuable experience can be gained through various avenues, and we value diverse experiences and unique perspectives.

Experience: 3-5 years of experience in Security and/or Identity Access Management. Experience supporting SOX and ITGC compliance audits. Strong analytical, problem-solving, and communication skills.

Education: Bachelor’s degree in Information Systems, Computer Science, or related field.

Oregon driver’s license required: No

Post-offer background check required: Yes

Post-offer drug test required: No

Post-offer physical/functional test required: No

Experience in one or more of the following areas would be particularly valuable:

• Strong hands-on experience with SAP role design and authorization concepts

• Experience with SAP Identity Access Governance (IAG) or similar GRC/IAM tools

• Solid understanding of Segregation of Duties (SoD) and access risk management

Please Note: Applicants must be authorized to work for any employer in the United States. EWEB is unable to sponsor or take over sponsorship of an employment Visa at this time.

Supplemental Questions

The application for this position includes supplemental questions. Your responses will be scored and used to determine if you will proceed to the next step of the selection process. Provide detailed answers to each question. Please do not reference your resume or application in your responses. Applications may be rejected if incomplete.

Equal Employment Opportunity

EWEB takes pride in our commitment to diversity and inclusion among our employees. We embrace and value differences of culture, education, experience, physical ability, and unique perspectives in our workplace. We invite applications from qualified candidates who share our commitment to diversity. Attracting, retaining, and advancing talent from all sources strengthens our bond with the multifaceted community we serve.

Tobacco, Smoke, and Vapor-Free Campus Policy

EWEB fosters an environment promoting good health for both employees and the public. We want to enhance the quality of air, appearance, and employee health in and around EWEB facilities and equipment. Employees, contractors, volunteers, and visitors may not use, distribute, or sell tobacco while participating in EWEB functions, on EWEB property, or while performing right-of-way tasks.

Other Requirements

This description is intended to represent key areas of responsibility. It is not meant to be all inclusive and does not prescribe or restrict the work that may be assigned. Nothing in this description restricts EWEB's right to assign or reassign duties and responsibilities to this job at any time. Job descriptions may occasionally be updated, as necessary, to reflect evolving business needs.