Product Security Senior Specialist (f/m/d) - Cyber Defense Operations

About the job

We help the world run better
At SAP, we keep it simple: you bring your best to us, and we'll bring out the best in you. We're builders touching over 20 industries and 80% of global commerce, and we need your unique talents to help shape what's next. The work is challenging – but it matters. You'll find a place where you can be yourself, prioritize your wellbeing, and truly belong. What's in it for you? Constant learning, skill growth, great benefits, and a team that wants you to grow and succeed.

Summary & Role Information:

Join SAP Cloud Infrastructure and help build the next generation of cloud services and platform capabilities powering SAP's sovereign and regulated cloud environments.

As a Product Security Senior Specialist, you will be the operational backbone of our Cyber Defense capability — coordinating and steering our external managed SOC partner, integrating security tooling into our cloud operations stack, and ensuring consistent detection, response, and monitoring across 30+ regional datacenters globally, from Australia to Toronto. You will work in close alignment with an internal Expert who leads the Cyber Defense topic strategically, while owning the day-to-day execution independently. We are looking for someone who is self-motivated, well-organized, and can operate with minimal supervision in a fast-moving, globally distributed environment.

What You'll Do:

• Serve as the primary operational interface to our external managed SOC provider and as the primary escalation contact for internal teams during security incidents. Steer service delivery, manage and prioritize the operational backlog, plan sprints and deliverables in line with shifting priorities, define and refine detection use cases, manage escalation processes, and ensure SLA adherence across all regions.
• Integrate and maintain the security toolbelt for SAP Cloud Infrastructure's logging, monitoring, and detection capabilities. Ensure tooling coverage keeps pace with platform expansion into new regions.
• Coordinate incident response processes between the external SOC, internal engineering teams, and stakeholders. Ensure timely triage, containment, and resolution of security events — executing against defined runbooks and operational processes, and continuously identifying improvements as the threat landscape and platform evolve.
• Work with the SOC provider and internal teams to develop and refine threat detection rules, analyze threat intelligence, and adapt the detection strategy to the evolving threat landscape for cloud infrastructure.
• Support vulnerability management processes for SAP Cloud Infrastructure, ensuring findings from scanning, penetration testing, and threat intelligence are tracked, prioritized, and remediated.
• Maintain operational metrics, dashboards, and reporting for Cyber Defense operations. Provide regular status updates to the Cyber Defense Expert and Security Engineering leadership. Identify gaps and inefficiencies in existing operational workflows and tooling, and drive actionable improvements.
• Adapt Cyber Defense operations, tooling, and processes as SAP Cloud Infrastructure expands into new regions with specific regulatory requirements.
• Collaborate across teams to transform security requirements into reliable and observable solutions.

What You Bring:

### Technical Foundation

• Several years of experience in security operations — SOC operations, incident response, threat detection, or vulnerability management — in a cloud or large-scale infrastructure environment.
• Hands-on experience managing security incidents, including triage, escalation, containment, and post-incident review in cloud or large-scale infrastructure environments.
• Experience coordinating or managing an external managed SOC provider, including service steering, use-case development, and escalation management.
• Working knowledge of logging, monitoring, and SIEM/SOAR tooling in cloud environments.
• Familiarity with OpenStack and/or Kubernetes from a security operations perspective.
• Experience operating security for multi-region, 24x7 datacenter environments.
• Familiarity with regulatory frameworks relevant to cloud infrastructure operations (e.g. ISO 27001, SOC 2, C5, BSI IT-Grundschutz, ANSSI SecNumCloud).
• Ability to work independently, prioritize across multiple regions and time zones, and manage operational complexity without close supervision.
• Proficiency in scripting and coding for automation of security operations tasks.

We don't expect you to have experience with every technology listed. If you have a strong foundation in several of these areas and are interested in learning the others, we'd be happy to hear from you.

### Core AI Skills

• AI-assisted engineering is part of how we work at SAP.
• Experience using AI tools for engineering tasks such as coding, troubleshooting, documentation, and automation.
• Ability to provide effective context and instructions and critically review AI-generated outputs before using them in production.
• Experience using AI to support automation, infrastructure tooling, or prototyping.
• Willingness to share useful AI practices and contribute to their responsible use within the team.

### Professional Skills

• Comfortable collaborating across teams, cultures, and locations and sharing knowledge with others.
• Able to communicate technical topics clearly, both verbally and in writing.
• Structured and reliable, with the ability to take ownership while working collaboratively. Able to manage a shifting backlog, re-prioritize deliverables as context changes, and keep external teams aligned to current priorities.
• Curious and pragmatic when approaching unfamiliar or complex problems.
• Strong stakeholder management skills, including the ability to navigate escalation paths and establish the right contact persons in the face of a dynamically growing organizational environment.
• Fluent English. German preferred. French appreciated.

### Tech You Bring

• SIEM/SOAR platforms
• Logging and monitoring tooling
• OpenStack or comparable cloud infrastructure platforms
• Kubernetes ecosystem
• GitHub for configuration and issue management
• Python, Bash, or comparable scripting languages
• Cloud computing environments
• Observability tools such as Prometheus and Grafana
• Threat intelligence platforms
• Ticketing systems such as Jira and ServiceNow

Meet the Team:

You will join SAP Cloud Infrastructure Security Engineering, where we build the infrastructure behind SAP's enterprise, sovereign, and regulated cloud environments using technologies such as OpenStack, Kubernetes/Gardener, Ceph, and Prometheus.

Our engineering culture is hands-on and collaborative. We work on real infrastructure problems, share what we learn, and believe a private cloud is something you build, not something you rent.

​