SAP Security Administrator II

This position opens on November 13, 2026, and will remain open until filled. The first review of applications will occur on November 30, 2026.

Eugene Water & Electric Board (EWEB) is seeking an experienced SAP Security Administrator II to lead and execute SAP security operations, access governance, and compliance initiatives across SAP and enterprise business applications. This role is responsible for advanced role design, Segregation of Duties (SoD) analysis, audit support, and optimization of identity and access processes.

The ideal candidate will have hands-on experience with SAP security and SAP Identity Access Governance (IAG) and will play a key role in strengthening access controls, improving governance processes, and supporting a secure and compliant enterprise environment.

Key Responsibilities

Access Governance & Provisioning

• Support the management of end-to-end user access lifecycle across SAP and integrated enterprise applications

• Design, implement, and optimize access request workflows and approval paths within IAG

• Ensure timely and accurate provisioning, modification, and de-provisioning of access in accordance with security policies

• Troubleshoot complex provisioning issues across SAP and connected systems

Role Design & Authorization Management

• Design, build, and maintain SAP roles using best practices (single roles, composite roles, derived roles) in SAP S/4HANA

• Analyze and maintain authorization objects, field values, and role hierarchies to enforce least privilege access

• Partner with business/functional stakeholders to translate functional requirements into secure and scalable role designs

• Continuously improve role design to reduce risk, redundancy, and complexity

Segregation of Duties (SoD) & Risk Management

• Perform advanced SoD analysis, risk identification, and remediation using IAG

• Define and maintain SoD rulesets, risk matrices, and mitigating controls

• Evaluate and approve mitigating controls in collaboration with audit and compliance teams

• Lead remediation efforts to resolve SoD conflicts while maintaining business continuity

Audit & Compliance

• Serve as a primary point of contact for internal and external audits (SOX, ITGC) related to SAP access

• Prepare and deliver audit evidence, including access reviews, role documentation, and control execution artifacts

• Support periodic user access reviews and certifications, ensuring completeness and accuracy

• Identify control gaps and implement corrective actions

Emergency Access & Monitoring

• Administer and monitor Firefighter (emergency access) IDs, ensuring proper usage, logging, review, and approval

• Investigate and resolve inappropriate or high-risk access usage

• Develop reporting and monitoring mechanisms for privileged access

Project Support & Functional Partnership

• Partner closely with SAP functional/technical teams to support security requirements for projects and enhancements

• Participate in project lifecycle activities including design, build, test, and deployment phases

• Translate functional specifications into secure role and authorization designs

• Perform security impact assessments for new implementations, upgrades, and changes.

• Support SAP projects such as migrations, enhancements, and transformations

• Ensure security is integrated into project deliverables, including role design, SoD analysis, and access provisioning

• Assist with testing activities (unit testing, integration testing, UAT) related to roles and authorizations

• Identify and mitigate security risks during project execution

• Collaborate with BASIS and technical teams on transports and system changes impacting security

• Provide guidance to functional teams on best practices for access control and compliance

Enterprise Application Security

• Extend access governance practices to enterprise business applications beyond SAP