Senior SAP BTP Platform & Security Engineer

Senior SAP BTP Platform & Security Engineer

Position Type: Contract

Experience Level: 12+ Years (Minimum 4+ years dedicated SAP BTP)

Location: Remote with travel

Role Summary

We are seeking a senior SAP BTP Platform & Security Engineer to spearhead the cloud infrastructure, connectivity, and enterprise security architecture required to deploy agentic AI (SAP Joule) and transactional integration with SAP S/4HANA. This role is responsible for establishing zero-trust identity architectures, configuring SAP Cloud Identity Services (IAS/IPS), standing up Cloud Connector environments, and establishing end-to-end Principal Propagation without relying on standard SaaS wrappers.

Core Responsibilities

•             Architect and provision SAP BTP subaccounts, multi-environment runtimes (Cloud Foundry, Kyma), and core services (SAP AI Core, Joule Studio, Destination Service).

•             Configure SAP Cloud Identity Services (IAS/IPS) as the central trust broker between corporate identity providers (Microsoft Entra ID, Okta) and SAP backends, ensuring proper Global User ID management.

•             Design, implement, and maintain Cloud Connector (SCC) configurations, including mutual TLS (mTLS), High Availability clusters, and System CA certificate automation.

•             Configure BTP Destinations supporting Principal Propagation via X.509 Certificate injection and OAuth2SAMLBearerAssertion for both on-premise/PCE and public cloud endpoints.

•             Partner with S/4HANA Basis and Security teams to validate end-to-end token exchange and authorization propagation (STRUST, CERTRULE, ICM parameters).

Required Technical Qualifications

•             BTP Core Services: Expert-level knowledge of BTP Cockpit, Entitlements management, Service Keys, Destination Service, and Connectivity Service.

•             Identity & Security: Deep hands-on experience with SAML 2.0, OpenID Connect (OIDC), OAuth 2.0 flows, and SAP Cloud Identity Services (IAS/IPS).

•             Enterprise Connectivity: Proven delivery of SAP Cloud Connector with System CA configuration for dynamic short-lived X.509 client certificate generation.

•             ERP Security Alignment: Solid understanding of how S/4HANA consumes identity tokens, specifically CERTRULE, EXTID_DN, and ICM profile parameters (icm/HTTPS/verify_client).