Careers at RedRays: help us secure the SAP systems the world runs on
RedRays is a small, senior team that finds and fixes security problems in SAP and Oracle ERP systems. We build our own security platform, ABAP code scanner and monitoring tools, run penetration tests for large enterprises, and publish research on SAP vulnerabilities. We're hiring for five remote SAP security jobs, from engineering to partnerships.
See open rolesApply nowWhy people join us
Work that matters
The systems we protect move payroll, payments and supply chains for big companies. When we find a hole, it gets fixed before someone else finds it.
Remote, for real
Work from wherever you do your best work. We have offices in the US and Armenia, but nobody has to sit in one.
Learn from specialists
Our team has spent more than ten years in SAP security research and has CVEs credited by SAP. You'll learn things that aren't in any course.
Small team, real ownership
No layers of approval. You'll own your work from the first idea to the customer conversation.
Fair, open pay
Every role below lists its salary range. Where you land depends on your experience, not on how well you negotiate.
Time to research
We encourage research, conference talks and responsible disclosure, and we give you time for them.
Open roles
All our SAP security jobs are full-time and remote. Salaries are yearly, gross, in US dollars. Click a role to read more.
SAP Security Analyst
Security assessments and customer projects⌄
SAP Security Analyst
Security assessments and customer projectsYou'll be the person who looks at a customer's SAP landscape and tells them, clearly, where they're exposed and what to fix first. Half of the job is technical analysis, the other half is explaining it so that a Basis admin and a CISO both understand it.
What you'll do
- Review SAP configurations, roles and authorizations, interfaces and patch levels
- Run scans with the RedRays platform and sort real risk from noise
- Write clear findings and remediation plans for customers
- Track SAP Security Patch Day and turn new SAP Notes into practical guidance
- Work with our engineers when a finding needs a deeper look
What we're looking for
- 2+ years in SAP Basis, SAP security or SAP GRC
- Good knowledge of SAP authorizations, SoD, RFC and transport management
- You can write a report that people actually read
- Comfortable working in English with international customers
Nice to have
- Experience with SAP BTP or S/4HANA migrations
- Security certifications or published research
SAP Security Engineer (Penetration Testing)
Offensive security and vulnerability research⌄
SAP Security Engineer (Penetration Testing)
Offensive security and vulnerability researchThis is for people who enjoy breaking things to make them safer. You'll run penetration tests against SAP NetWeaver, S/4HANA and SAP BTP for enterprise customers, and spend part of your time on research that ends up in our products and in SAP Security Notes.
What you'll do
- Run penetration tests on SAP ABAP and Java stacks, Fiori, OData, RFC and BTP
- Find, prove and clearly document attack paths
- Research new SAP vulnerabilities and report them responsibly to SAP
- Turn your findings into checks for the RedRays platform
- Present results to customer security teams
What we're looking for
- 3+ years in penetration testing or application security
- Hands-on experience attacking SAP, or strong web and network pentesting skills and a real interest in learning SAP
- Comfortable with Burp Suite, scripting in Python and reading code
Nice to have
- CVEs, bug bounty results or conference talks
- OSCP, OSWE or similar
- ABAP or Java code review experience
Senior Java Developer
RedRays Security Platform⌄
Senior Java Developer
RedRays Security PlatformYou'll build the backend of the RedRays Security Platform: the connectors that pull data from SAP, Oracle, Microsoft and Linux systems, the rule engine that decides what's suspicious, and the services that send alerts to a customer's SOC. It has to run reliably inside very large and very careful companies.
What you'll do
- Design and build backend services and connectors in Java
- Work on the monitoring pipeline: connector, sensor, rule, result, response
- Make the platform fast, secure and easy to install on-premise
- Review code, write tests and help shape the architecture
- Talk to our security engineers to understand what customers need
What we're looking for
- 5+ years of professional Java development (Java 17+, Spring)
- Solid experience with REST APIs, SQL databases and messaging
- You write secure code by habit, not as an afterthought
- Experience shipping software that customers run themselves
Nice to have
- SAP JCo, RFC or OData integration
- Experience with SIEM integrations (Microsoft Sentinel, Splunk)
- Docker and Kubernetes
ABAP Developer
SAP-side components and ABAP code security⌄
ABAP Developer
SAP-side components and ABAP code securityOur products live inside SAP, so we need someone who knows ABAP really well. You'll build the SAP-side parts of our platform and help our ABAP code scanner understand what secure and insecure ABAP actually looks like.
What you'll do
- Develop and maintain the ABAP components and add-ons of our products
- Write and review ABAP test cases, both vulnerable and safe, for our code scanner
- Help customers fix the security issues our scanner finds in their custom code
- Keep our components compatible across ECC, S/4HANA and ABAP Cloud
What we're looking for
- 4+ years of ABAP development, including OO ABAP
- Experience with RFC, BAPIs, OData and transport management
- You understand common risks like SQL injection, missing authority checks and code injection in ABAP
Nice to have
- ABAP Cloud, RAP or CAP experience
- ATC and Code Vulnerability Analyzer
- Some Java or Python
Partnerships Manager
Channel partners and alliances⌄
Partnerships Manager
Channel partners and alliancesWe work with consulting firms, resellers and security vendors around the world. You'll find the right partners, help them succeed with RedRays and turn those relationships into real projects. If you like building long-term relationships more than chasing one-off deals, you'll enjoy this role.
What you'll do
- Find and sign new consulting, reseller and technology partners
- Onboard partners and train their teams on our products
- Plan joint campaigns, webinars and events with partners
- Manage the partner pipeline in HubSpot and report on results
- Represent RedRays at conferences and partner events
What we're looking for
- 3+ years in partner, channel or alliance management, ideally in B2B software or cybersecurity
- A network in the SAP or security ecosystem
- Strong written and spoken English; other languages are a plus
- Comfortable with occasional travel
Nice to have
- Experience with SAP PartnerEdge or SAP Store
- Experience with MSSP or consulting partners
Don't see a role that fits? Send us an open application anyway. We're always happy to hear from people who care about SAP security.
How hiring works
Apply
Send your CV with the form below. It takes about two minutes.
Intro call
A short call to get to know each other and answer your questions.
Practical task
A small task close to the real work. No trick puzzles.
Meet the team
Talk with the people you'll work with, then we make a decision.
Apply for a role at RedRays
Choose the role, attach your CV and tell us a bit about yourself.