If you are running SG version 25.0 or above, you can use environment variables in the Search Guard configuration files.
For example, if the password hash for your admin user is stored in an environment variable called ADMIN_PWD_HASH you can use it like:
admin:
hash: ${env.ADMIN_PWD_HASH}
If your cleartext password is stored in an environment variable called ADMIN_PWD, SG can automatically convert it to a hash when replacing the variables, like:
admin:
hash: ${envbc.ADMIN_PWD}