Application Security Consultant

C5MI is not your typical consulting firm. We are a high-performance team of SAP and supply chain experts who solve complex, mission critical challenges for organizations that cannot afford failure.

We hire consultants who thrive in complexity, move fast, take ownership, and deliver under pressure. At C5MI, you will not be siloed or stuck in theory. You will be hands on, client facing, and directly influencing outcomes that matter.

Our culture rewards initiative, accountability, and continuous growth. This is a place where your expertise is valued, your work is meaningful, and your performance truly matters. If you’re energized by learning through real-world challenges, collaborating with top-tier talent, and expanding your capabilities every day, C5MI is where strong consultants level up.

Position Summary:   

The Senior Application Security SAP Consultant is responsible for SAP application security and governance, risk, and compliance within an SAP S/4HANA environment, covering authorization design, role management, segregation of duties enforcement, and the access control evidence required to sustain system authorization and support financial audit, in support of a large-scale, greenfield SAP S/4HANA financial management modernization program for a Department of War (DoW) organization. As the senior SAP security authority on the program, the consultant owns the authorization concept and segregation of duties architecture, designs the governance, risk, and compliance control framework, and is accountable for access control evidence at audit and authorization milestones. This position operates at the Senior level of the C5MI job architecture and contributes to delivery across a five-gate milestone structure spanning pre-design approval, preliminary design review, critical design review, production readiness review, and closeout. 

Note:  This position is contingent upon contract award. 

Essential Functions and Responsibilities: 

• Owns the SAP authorization concept for the program, including the role architecture, naming standards, derivation strategy, and the governance process for role change. 

• Designs the segregation of duties framework, including ruleset design and customization, risk definitions, and the mitigating control catalog with assigned ownership and monitoring frequency. 

• Designs the governance, risk, and compliance solution architecture across access risk analysis, access request management, business role management, and emergency access management. 

• Designs preventive segregation of duties enforcement so that access risk is evaluated and resolved before provisioning rather than detected after the fact, including risk simulation within the request workflow.