Senior DevOps Engineer - Security, Observability & Incident Response

Senior Dev Ops Engineer - Security, Observability & Incident Response

We help the world run better At SAP, we keep it simple: you bring your best to us, and we'll bring out the best in you. We're builders touching over 20 industries and 80% of global commerce, and we need your unique talents to help shape what's next. The work is challenging – but it matters. You'll find a place where you can be yourself, prioritize your wellbeing, and truly belong.

What's in it for you? Constant learning, skill growth, great benefits, and a team that wants you to grow and succeed.

Please note:
This position will be based from our San Ramon office following our hybrid working model of in-office 3 days a week. There is no relocation assistance available for this role.

We are seeking a highly skilled and proactive Security & Observability Engineer to join our Cloud Operations Tools team. This role is integral in maintaining, optimizing, and managing our Observability and Security toolsets, with a strong focus on improving end‑to‑end visibility, enhancing system reliability, strengthening detection capabilities, and reducing MTTR. The ideal candidate will have deep hands‑on expertise with Observability platforms—especially Dynatrace—alongside SIEM tools, strong incident response capabilities, and a passion for automation and continuous improvement.

• Own and administer the enterprise Dynatrace environment including configuration, tuning, tagging, dashboards, alerting, and synthetic monitoring.
• Develop and maintain service-level dashboards, distributed tracing views, and health analytics to support SRE, Dev Ops, and app teams.
• Optimize observability coverage across infrastructure, applications, APIs, and cloud platforms to reduce blind spots and improve MTTR.
• Partner with application and operations teams to drive root‑cause analysis using Dynatrace insights and AIOps capabilities.
• Ensure observability best practices around instrumentation, ingest pipelines, tagging standards, and anomaly detection models.
• Strong understanding of Open Telemetry architecture, including Traces, Metrics, and Logs.
• Understanding of OTel's data model, context propagation, sampling, and exporters.

• Manage and tune SIEM solutions such as Splunkto ensure effective threat detection.
• Build and enhance detection rules, alerts, and dashboards.
• Perform log source onboarding and parsing improvements.
• Support SAP & LOB IR teams during security incidents.
• Conduct triage, investigation, containment, eradication, and recovery activities.
• Coordinate with internal and external stakeholders during and after incidents.
• Administer and monitor endpoint security tools such as Crowd Strike, Trend Micro.
• Review threat detections and drive remediation efforts.

• Support vulnerability management processes by correlating scanner output with asset context and threat intelligence.
• Partner with IT and development teams to prioritize and remediate vulnerabilities.

• Build automation workflows using SOAR platforms or scripting (Python, Power Shell, Bash, etc.).
• Streamline repetitive IR and security operations tasks.

• Maintain accurate documentation for operations, procedures, configurations, and incident records.
• Create regular reporting on security posture, observability health, and response metrics.
• Collaborate with IT, Dev Ops, SRE, and Compliance teams.
• Provide input into architecture, tool selection, observability strategy, and security initiatives.

• 3–7 years of experience in security operations, observability engineering, or incident response.
• Expert-level hands‑on experience with Dynatrace (required)—including configuration, dashboards, tagging, integrations, service flows, and alerting.
• Strong expertise with SIEM platforms (especially Splunk).
• Solid understanding of IR lifecycle and best practices.
• Experience with endpoint protection platforms (Crowd Strike, Trend Micro, McAfee, etc.).
• Familiarity with vulnerability scanning solutions (Tenable, Rapid7, Qualys).
• Strong scripting and automation skills (Python, Power Shell, Bash).
• Strong…