Corporate Security Manager - SAP

Act in the role of a Corporate Security Manager to lead in the planning and design, and possible development and implementation of infrastructure related security. The focus will initially on our core SAP systems.  Tailoring IT security policy requirements of parent company to satisfy specific America?s requirements, develop corporate security education curriculum, establish and perform necessary security audit programs, work with corporate Audit and external Audit engagements of IT general and application controls.  Develop, publish, educate through security staff, RISC committee and others required policies that establish the framework for:

1)  Logon id?s, duration of privilege, etc.

2)  Password rules

3)  Access guidelines by position or role (for all systems)

4)  Processes for review of rule/guideline routinely (audit results and non compliance corrective steps) consistent with COBIT

5)  Propose a system/tool solution set that works within our current/planned infrastructure architecture

6)  Utilize Versa as a control and management tool for security compliance.

  Training required to insure compliance to processes and procedure

 

Accountabilities:

-  Assess clients' security and control readiness and provide appropriate security input

-  Understand and document present security processes and controls

-  Review and align business process control design or re-engineering

-  Perform security audit and vulnerability assessments including network attack & penetration testing, host security diagnostics, exercises, and Web application security testing

-  Define risk analysis & mitigation methodology, security policy and procedure development, incident response program, patch management and vulnerability management processes, security training & awareness

-  Write report segments and  participate in presentations

-  Recommend infrastructure security design (and implementation if required)

-  Assure regulatory compliance (security and privacy) assessment and security safeguard implementation

-  Play a key role in the implementation of security recommendations and audit techniques

-  Participate in training efforts

 

Requirements

 

-  7 years of experience in network and system security design and implementation

-  Minimum of 5 years of SAP security administration experience

-  3+ years of technical experience in network security products and in Operating System security particularly IBM-AIX **

-  Knowledge of COBIT methodology

-  Experience with Sarbanes Oxley 404 internal control attest and readiness requirements

-  Understanding of segregation of duty concerns with respect to application security implementations

-  Familiarity with programming languages such as PERL, C++, Java, XML, HTML

-  Must have worked with external auditors

-  Understanding of basic security protocols such as Kerberos, RADIUS, TACACS+, SSL, TLS, SSH, IPSec, S/MIME, and SFTP

-  Understanding of system development lifecycle and IT management processes such as change management, production readiness, help desk, etc.

-  Lead role in infrastructure security a plus

-  Knowledge of SAP Virsa tool a plus

-  CISA, CISSP or CCNA Certification a plus

 

? Multiple implementation experience (minimum of four life cycles).  Support experience would be a plus.

? Experience in ECC 5.0 Security preferred.  Must be knowledgeable on SAP 4.6.  Knowledge of 3.1 also preferred.

? Security experience with APO, BW, SEM and other SAP applications

? Hands on knowledge of SAP security processes and their relationship to users of transactions, roles, duty segregation, composite roles.

? Familiarity with Virsa Compliance Calibrator

? Proven capability for strategy, application usage and ability to apply knowledge of various business processes / functional areas as they relate to overall security requirements.

? Understanding of Sarbanes Oxley compliance and how it relates to COSO.

 

Additional desired competencies:

? Experience in the design and architecture of solutions related to security, including AAA, intrusion detection and prevention, remote access, caching, firewalls, encryption, PKI and vulnerability management.

? Experience in AD deployment and utilization to achieve desired access and sign-on permissions.

? Researching and analyzing new security technologies with a focus on the introduction of relevant technology to meet global business requirements.

? General engineering consultancy to support Service Delivery and project driven initiatives