Senior SAP BTP Platform & Security Engineer
Position Type: Contract
Experience Level: 7+ Years (Minimum 3+ years dedicated SAP BTP)
Location: Remote with travel
Role Summary
We are seeking a senior SAP BTP Platform & Security Engineer to spearhead the cloud infrastructure, connectivity, and enterprise security architecture required to deploy agentic AI (SAP Joule) and transactional integration with SAP S/4HANA. This role is responsible for establishing zero-trust identity architectures, configuring SAP Cloud Identity Services (IAS/IPS), standing up Cloud Connector environments, and establishing end-to-end Principal Propagation without relying on standard SaaS wrappers.
Core Responsibilities
• Architect and provision SAP BTP subaccounts, multi-environment runtimes (Cloud Foundry, Kyma), and core services (SAP AI Core, Joule Studio, Destination Service).
• Configure SAP Cloud Identity Services (IAS/IPS) as the central trust broker between corporate identity providers (Microsoft Entra ID, Okta) and SAP backends, ensuring proper Global User ID management.
• Design, implement, and maintain Cloud Connector (SCC) configurations, including mutual TLS (mTLS), High Availability clusters, and System CA certificate automation.
• Configure BTP Destinations supporting Principal Propagation via X.509 Certificate injection and OAuth2SAMLBearerAssertion for both on-premise/PCE and public cloud endpoints.
• Partner with S/4HANA Basis and Security teams to validate end-to-end token exchange and authorization propagation (STRUST, CERTRULE, ICM parameters).
Required Technical Qualifications
• BTP Core Services: Expert-level knowledge of BTP Cockpit, Entitlements management, Service Keys, Destination Service, and Connectivity Service.
• Identity & Security: Deep hands-on experience with SAML 2.0, OpenID Connect (OIDC), OAuth 2.0 flows, and SAP Cloud Identity Services (IAS/IPS).
• Enterprise Connectivity: Proven delivery of SAP Cloud Connector with System CA configuration for dynamic short-lived X.509 client certificate generation.
• ERP Security Alignment: Solid understanding of how S/4HANA consumes identity tokens, specifically CERTRULE, EXTID_DN, and ICM profile parameters (icm/HTTPS/verify_client).
