Applications Security Analyst

POSITION PURPOSE

The Application Security Analyst supports the application security function within the Digital Applications & Product Delivery organization, helping to protect BAC’s enterprise application estate through sound access governance, security administration, and support of security and compliance activities. SAP S/4HANA and the wider SAP landscape are the primary focus and the largest share of the work, but the role supports application security across the wider estate, including non-SAP business applications.

This is a developing role suited to someone early in an application security career. Working under the guidance of senior application security and business analysis colleagues, the analyst carries out the day-to-day tasks that keep application access controlled and auditable - building and maintaining SAP roles, processing access, supporting segregation of duties and access reviews, and helping prepare audit evidence - while building the deeper expertise to take on more complex security work overtime.

The successful candidate combines a foundational understanding of SAP authorizations and security concepts with strong attention to detail, a disciplined and control-minded approach, and the curiosity to grow into a broader application security specialist.

PRINCIPAL ACCOUNTABILITIES

SAP Roles & Authorizations

· Build, maintain, and test SAP roles, profiles, and authorizations in line with design specifications and established security standards, under the guidance of senior colleagues.

· Troubleshoot authorization errors, analyzing missing objects and values and proposing appropriate role changes for review.

· Support role redesign, cleanup, and remediation activities across the SAP landscape.

· Maintain accurate documentation of roles, authorization designs, and changes to support transparency and audit.

Access Management & Provisioning

· Process user access requests across SAP and, where required, non-SAP applications, strictly in line with approved access request and approval workflows.

· Create, amend, and deactivate user accounts and access accurately and within agreed service levels.

· Escalate, without exception, any request that appears to breach segregation of duties, approval policy, or established controls.

· Maintain complete and accurate records of access changes to support internal and external audit requirements.

Segregation of Duties, Reviews & Compliance Support

· Support segregation of duties (SoD) analysis using SAP GRC or equivalent tooling, preparing reports, identifying conflicts, and tracking remediation under senior guidance.

· Support periodic user access reviews and role recertification, preparing extracts, coordinating with reviewers, chasing responses, and recording outcomes.

· Help prepare evidence and respond to internal and external audit requests relating to application access and security controls (for example SOX ITGC).

· Help maintain the SoD rule set and control documentation under the direction of senior application security colleagues.

Security Operations Support & Monitoring

· Support day-to-day application security operations, including monitoring access logs and security-relevant reports and flagging anomalies for review.

· Assist with the application-layer aspects of security patching, vulnerability remediation, and security acceptance for releases, in coordination with development, SAP Basis, and the Infrastructure, Operations & Security team.

· Support security testing and validation activities during projects, upgrades, and new application deployments.

· Escalate potential security incidents promptly and support their investigation and resolution.

Collaboration, Learning & Continuous Improvement

· Work closely with SAP Business Analysts, application support, developers, and the Infrastructure, Operations & Security team on access and security matters.

· Build knowledge of the wider application estate and of security concepts beyond SAP, growing toward a broader application security capability.

· Contribute to knowledge base articles, standard operating procedures, and continuous improvement of access and security processes, including automation of routine tasks.

· Maintain awareness of relevant security policies, standards, and good practice, and apply them consistently.

NATURE AND SCOPE

The Application Security Analyst reports to the Global Senior Manager, Digital Applications within the Digital Applications & Product Delivery organization and works under the day-to-day guidance of senior application security and business analysis colleagues. There are no direct reports to this position.

The role focuses primarily on SAP application security while supporting security across the wider application estate. It operates within the access control, change management, and audit procedures owned by the Digital Applications & Product Delivery organization, and works alongside the Infrastructure, Operations & Security organization, which owns the enterprise security programs, identity platform, and cyber security operations.

PERFORMANCE INDICATORS

· Accuracy and timeliness of role builds, authorization changes, and access provisioning.

· Zero unapproved or policy-breaching access grants.

· Quality and completeness of SoD analysis, access review, and audit evidence prepared.

· Timeliness and quality of support to audits, with findings avoided or remediated on schedule.

· Completeness and currency of role and control documentation.

· Demonstrable growth in application security knowledge and increasing autonomy over time.

No grants of authority have been assigned to the Application Security Analyst. Access and role changes are executed strictly against approved requests and designs and do not constitute approval authority.

The Application Security Analyst maintains regular contact with senior application security and SAP Business Analysis colleagues; application support and development teams; SAP Basis colleagues; the Infrastructure, Operations & Security team; Internal Audit and Compliance; and business users in relation to access requests and reviews.

KNOWLEDGE & SKILLS

· Bachelor’s degree in information technology, computer science, information security, business, or a related field, or equivalent practical experience.

· Around 1 to 2 years of experience in SAP security, IT access administration, application support, or a related role; strong candidates earlier in their career will be considered.

· Foundational understanding of SAP authorization concepts - users, roles, profiles, authorization objects — and of common authorization error patterns.

· Exposure to SAP GRC Access Control or a similar access governance or SoD tool, or a strong willingness to learn it.

· Understanding of access management principles, segregation of duties, and least-privilege access.

· Awareness of IT general controls and audit concepts (for example SOX, GDPR) as they apply to application access.

· Strong attention to detail, a disciplined and control-minded approach, and sound documentation habits.

· Good analytical and problem-solving skills, and the discipline to follow defined procedures precisely.

· Clear written and verbal communication in English, and the ability to work effectively in a global, multicultural team.

· Genuine interest in application and information security, with the motivation to develop into a broader security specialist.

Preferred

· A foundational security certification (for example CompTIA Security+ or equivalent), or willingness to work toward one.

· Exposure to security concepts beyond SAP, such as identity and access management, Microsoft 365 security, or application vulnerability management.

· Experience supporting an audit or a SoD remediation exercise.

· Experience in a manufacturing or engineer-to-order environment.

WORKING CONDITIONS

The physical demands described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. While performing the duties of this job, the employee is regularly required to stand and walk up to 50% of the time. Working conditions include those of a normal construction environment, as well as standard hazards associated with installed HVAC equipment and rotating equipment. This position requires occasional lifting of up to 30 lbs, and travel of 10 - 20% of the time.