{"id":4292731,"url":"https://alion.io/job/eweb-sap-security-administrator-ii","title":"SAP Security Administrator II","company":{"id":1909541,"name":"EWEB","domain":"eweb.org","url":"https://alion.io/company/eweb-org","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"UltiPro","truth_index":null},"role":"Enterprise Apps","role_family":"Enterprise Apps","seniority":"middle","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Eugene, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false}],"status":"live","first_seen_at":"2026-11-13T20:06:24Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T23:55:38Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"This position opens on November 13, 2026, and will remain open until filled. The first review of applications will occur on November 30, 2026.\nEugene Water & Electric Board (EWEB) is seeking an experienced SAP Security Administrator II to lead and execute SAP security operations, access governance, and compliance initiatives across SAP and enterprise business applications. This role is responsible for advanced role design, Segregation of Duties (SoD) analysis, audit support, and optimization of identity and access processes.\nThe ideal candidate will have hands-on experience with SAP security and SAP Identity Access Governance (IAG) and will play a key role in strengthening access controls, improving governance processes, and supporting a secure and compliant enterprise environment.\nKey Responsibilities\nAccess Governance & Provisioning\nSupport the management of end-to-end user access lifecycle across SAP and integrated enterprise applications\nDesign, implement, and optimize access request workflows and approval paths within IAG \nEnsure timely and accurate provisioning, modification, and de-provisioning of access in accordance with security policies \nTroubleshoot complex provisioning issues across SAP and connected systems \nRole Design & Authorization Management\nDesign, build, and maintain SAP roles using best practices (single roles, composite roles, derived roles) in SAP S/4HANA\nAnalyze and maintain authorization objects, field values, and role hierarchies to enforce least privilege access \nPartner with business/functional stakeholders to translate functional requirements into secure and scalable role designs \nContinuously improve role design to reduce risk, redundancy, and complexity \nSegregation of Duties (SoD) & Risk Management\nPerform advanced SoD analysis, risk identification, and remediation using IAG \nDefine and maintain SoD rulesets, risk matrices, and mitigating controls \nEvaluate and approve mitigating controls in collaboration with audit and compliance teams \nLead remediation efforts to resolve SoD conflicts while maintaining business continuity \nAudit & Compliance\nServe as a primary point of contact for internal and external audits (SOX, ITGC) related to SAP access\nPrepare and deliver audit evidence, including access reviews, role documentation, and control execution artifacts \nSupport periodic user access reviews and certifications, ensuring completeness and accuracy\nIdentify control gaps and implement corrective actions\nEmergency Access & Monitoring\nAdminister and monitor Firefighter (emergency access) IDs, ensuring proper usage, logging, review, and approval \nInvestigate and resolve inappropriate or high-risk access usage\nDevelop reporting and monitoring mechanisms for privileged access \nProject Support & Functional Partnership\nPartner closely with SAP functional/technical teams to support security requirements for projects and enhancements \nParticipate in project lifecycle activities including design, build, test, and deployment phases\nTranslate functional specifications into secure role and authorization designs \nPerform security impact assessments for new implementations, upgrades, and changes. \nSupport SAP projects such as migrations, enhancements, and transformations \nEnsure security is integrated into project deliverables, including role design, SoD analysis, and access provisioning \nAssist with testing activities (unit testing, integration testing, UAT) related to roles and authorizations \nIdentify and mitigate security risks during project execution\nCollaborate with BASIS and technical teams on transports and system changes impacting security \nProvide guidance to functional teams on best practices for access control and compliance\nEnterprise Application Security\nExtend access governance practices to enterprise business applications beyond SAP \nEnsure consistent identity and access controls across integrated systems \nCollaborate with application owners to standardize provisioning and access review processes \nProcess Improvement & Automation\nIdentify opportunities to automate manual access management processes within IAG \nEnhance workflows, notifications, and approval chains to improve efficiency and user experience \nDrive continuous improvement initiatives in access governance and compliance processes \nCollaboration & Leadership\nAct as a subject matter expert (SME) for SAP security and access governance\nMentor junior analysts and provide guidance on best practices \nCollaborate with BASIS, functional/technical teams, and IS security architects to align security strategies\nParticipate in security design discussions for new SAP implementations or enhancements\nWhat You’ll Bring\nRecommended Qualifications\nExperience with SAP S/4HANA security design and Fiori authorization concepts \nFamiliarity with SAP GRC Access Control or other IAM platforms\nKnowledge of integration between SAP and enterprise identity systems \nExperience supporting cloud and hybrid SAP environments\nKey Skills\nAdvanced User Access Management (UAM) \nSAP Role Design & Authorization Objects \nSegregation of Duties (SoD) Analysis & Remediation \nIdentity Access Governance (IAG)\nAudit & Compliance (SOX, ITGC)\nProcess Improvement & Automation\nCross-application access governance \nStakeholder communication and leadership \nLocation: This position is based in Eugene, Oregon; it has been approved as a hybrid work arrangement involving a combination of telecommuting and working onsite. The selected candidate must live in the state of Oregon.\nCompensation & Benefits\nThe starting annual salary for this position is $96,523.58 to $120,654.48 commensurate with knowledge, skills, education, and experience as it relates to the position.\nThe base pay offered will be established based on multiple factors, including job-related knowledge and skills, relevant experience, and internal equity. Consistent with EWEB’s compensation philosophy, it is not customary to place individuals at the high end of the salary range at the time of hire. Compensation decisions are made holistically to support fair, consistent, and equitable pay practices, taking into account the specific circumstances of each position and candidate.\nEWEB values total worker health, both at work and at home, and provides a robust compensation & benefits package. - Read more about our benefits.\nQualifications & Requirements\nEWEB will consider an equivalent combination of relevant education and experience when reviewing applications. Candidates who do not meet all the minimum qualifications, but whose application materials demonstrate the necessary knowledge, skills, and abilities to be successful in the position, are encouraged to apply. We understand that valuable experience can be gained through various avenues, and we value diverse experiences and unique perspectives.\nExperience: 3-5 years of experience in Security and/or Identity Access Management. Experience supporting SOX and ITGC compliance audits. Strong analytical, problem-solving, and communication skills.\nEducation: Bachelor’s degree in Information Systems, Computer Science, or related field.\nOregon driver’s license required: No\nPost-offer background check required: Yes\nPost-offer drug test required: No\nPost-offer physical/functional test required: No\nExperience in one or more of the following areas would be particularly valuable:\nStrong hands-on experience with SAP role design and authorization concepts\nExperience with SAP Identity Access Governance (IAG) or similar GRC/IAM tools\nSolid understanding of Segregation of Duties (SoD) and access risk management\nPlease Note: Applicants must be authorized to work for any employer in the United States. EWEB is unable to sponsor or take over sponsorship of an employment Visa at this time.\nSupplemental Questions\nThe application for this position includes supplemental questions. Your responses will be scored and used to determine if you will proceed to the next step of the selection process. Provide detailed answers to each question. Please do not reference your resume or application in your responses. Applications may be rejected if incomplete.\nEqual Employment Opportunity\nEWEB takes pride in our commitment to diversity and inclusion among our employees. We embrace and value differences of culture, education, experience, physical ability, and unique perspectives in our workplace. We invite applications from qualified candidates who share our commitment to diversity. Attracting, retaining, and advancing talent from all sources strengthens our bond with the multifaceted community we serve.\nTobacco, Smoke, and Vapor-Free Campus Policy\nEWEB fosters an environment promoting good health for both employees and the public. We want to enhance the quality of air, appearance, and employee health in and around EWEB facilities and equipment. Employees, contractors, volunteers, and visitors may not use, distribute, or sell tobacco while participating in EWEB functions, on EWEB property, or while performing right-of-way tasks.\nOther Requirements\nThis description is intended to represent key areas of responsibility. It is not meant to be all inclusive and does not prescribe or restrict the work that may be assigned. Nothing in this description restricts EWEB's right to assign or reassign duties and responsibilities to this job at any time. Job descriptions may occasionally be updated, as necessary, to reflect evolving business needs.","description_format":"text","description_chars":9421,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Hybrid work"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Power Grid","Water Utilities"],"lifecycle":[{"event":"open","at":"2026-11-13T23:55:38Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":27,"reasons":["conf:1","win:early"],"computed_at":"2026-11-14T01:40:13Z"},"pay":null,"html_url":"https://alion.io/job/eweb-sap-security-administrator-ii","json_url":"https://alion.io/job/eweb-sap-security-administrator-ii.json","meta":{"generated_at":"2026-11-14T01:40:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1575,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1909541},"rest":"https://alion.io/mcp/rest/get_company?id=1909541"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Feweb-sap-security-administrator-ii"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Feweb-sap-security-administrator-ii"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Feweb-sap-security-administrator-ii"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/eweb-sap-security-administrator-ii\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Feweb-sap-security-administrator-ii"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4292731}},{"tool":"search_jobs","arguments":{"company":"eweb.org","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4292731},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}