Cyber
Deloitte Cyber understands that SAP and ERP platforms form the backbone of many enterprises but also face unique and evolving cybersecurity challenges. Our team partners with organizations to fortify their SAP environments by combining vulnerability management, offensive security expertise, DevSecOps integration, and advanced threat modeling using industry-leading tools and deep SAP functional knowledge. Join us in helping clients safeguard their most critical business assets and processes.
Position Summary
Level: Senior Solution Advisor
Work you’ll do:
As a Senior Solution Advisor specializing in SAP/ERP vulnerability management, offensive penetration testing, DevSecOps, and threat modeling, your responsibilities will include:
- SAP Application Security Assessment: Execute vulnerability assessments and penetration testing for SAP platforms across web and thick client applications (ECC, S/4HANA, Fiori, SAP GUI).
- Tool-Based Assessments: Utilize advanced SAP security and assessment tools including Onapsis, RedRays, SecurityBridge, Metasploit, PySAP, and others for comprehensive vulnerability discovery, business logic flaw detection, custom code analysis, and configuration review.
- SAP DevSecOps Integration: Embed automated SAP security scanning within CI/CD pipelines, establish security gates for SAP code transport and deployment processes, and drive DevSecOps practices throughout SAP solution development and operations.
- SAP Threat Modeling: Conduct risk-based SAP threat modeling (using frameworks like STRIDE, PASTA, etc.), map out attack surfaces specific to SAP landscapes, and translate modeling outputs into practical vulnerability testing and mitigation.
- ABAP/Technical SAP Expertise: Employ strong ABAP development and debugging skills to identify custom code vulnerabilities and support technical remediation.
- Vulnerability Lifecycle Management: Manage SAP vulnerabilities through their lifecycle documenting, triaging, coordinating remediation, and validating through retesting.
- Collaboration and Guidance: Work closely with SAP BASIS, application, and security teams to implement secure-by-design controls, define DevSecOps practices, and support both operational and compliance objectives.
- Reporting & Education: Prepare detailed vulnerability and threat modeling reports, present risk findings to stakeholders, and facilitate training to continually raise SAP security maturity within client organizations.
- Continuous Learning: Maintain ongoing awareness of SAP threat landscape, new vulnerabilities, tool updates, and emerging DevSecOps and threat modeling methodologies.
The Team:
Deloitte’s Enterprise Security team delivers security by design across digital transformation initiatives-focusing on technical backbone systems like SAP. We provide end-to-end application security, DevSecOps enablement, threat modeling, and offensive testing for leading enterprise software landscapes.
Qualifications
Must Have Skills/Project Experience/Certifications:
- 7–9 years of deep hands-on experience in SAP/ERP security, offensive testing, and vulnerability management.
- Strong practitioner skills with SAP security testing tools (Onapsis, RedRays, SecurityBridge, PySAP, Metasploit for SAP modules).
- Demonstrable experience integrating SAP security testing in DevSecOps/CI-CD lifecycles (e.g., Jenkins, Azure DevOps, GitLab) and automating checks for SAP applications and transports.
- Expertise in SAP-specific threat modeling using approaches like STRIDE, PASTA, or custom SAP methods able to define, document, and prioritize SAP attack vectors and translate them to actionable test cases.
- Substantial SAP technical foundation, including ABAP code review and debugging, NetWeaver, S/4HANA, SAP Fiori, and system hardening.
- Ability to communicate SAP vulnerability findings and remediation steps clearly to both technical and non-technical audiences.
- Proven track record collaborating in cross-functional SAP/ERP project environments.
Good to Have Skills/Project Experience/Certifications:
· SAP security certifications, offensive security certifications (e.g., SAP Security, OSCP, CEH, CSSLP).
· Experience with regulatory and compliance-driven SAP risk management (GDPR, SOX, etc.).
· Practical knowledge of cloud or hybrid SAP deployments, and continuous compliance monitoring.
· Familiarity with SAP Secure by Design frameworks, container security, and modern application architectures.
Education:
· Bachelor’s degree or higher in Computer Science, Information Security, or a related field; SAP certifications preferable.
Location:
· Bangalore, Hyderabad, Pune, Chennai, Kolkata
#Cyber_Enterprise
#CA - VKS