Recently postedTechnology

Senior SAP BTP Platform & Security Engineer

NsightUnited States🇺🇸United States

Quick overview

SeniorityMid Senior

Work modeHybrid

LocationUnited States

OAuthSAMLHTTPSOkta

Job description

Role Summary

We are seeking a senior SAP BTP Platform & Security Engineer to spearhead the cloud infrastructure, connectivity, and enterprise security architecture required to deploy agentic AI (SAP Joule) and transactional integration with SAP S/4HANA. This role is responsible for establishing zero-trust identity architectures, configuring SAP Cloud Identity Services (IAS/IPS), standing up Cloud Connector environments, and establishing end-to-end Principal Propagation without relying on standard SaaS wrappers.

Core Responsibilities

• Architect and provision SAP BTP subaccounts, multi-environment runtimes (Cloud Foundry, Kyma), and core services (SAP AI Core, Joule Studio, Destination Service).

• Configure SAP Cloud Identity Services (IAS/IPS) as the central trust broker between corporate identity providers (Microsoft Entra ID, Okta) and SAP backends, ensuring proper Global User ID management.

• Design, implement, and maintain Cloud Connector (SCC) configurations, including mutual TLS (mTLS), High Availability clusters, and System CA certificate automation.

• Configure BTP Destinations supporting Principal Propagation via X.509 Certificate injection and OAuth2SAMLBearerAssertion for both on-premise/PCE and public cloud endpoints.

• Partner with S/4HANA Basis and Security teams to validate end-to-end token exchange and authorization propagation (STRUST, CERTRULE, ICM parameters).

Required Technical Qualifications

• BTP Core Services: Expert-level knowledge of BTP Cockpit, Entitlements management, Service Keys, Destination Service, and Connectivity Service.

• Identity & Security: Deep hands-on experience with SAML 2.0, OpenID Connect (OIDC), OAuth 2.0 flows, and SAP Cloud Identity Services (IAS/IPS).

• Enterprise Connectivity: Proven delivery of SAP Cloud Connector with System CA configuration for dynamic short-lived X.509 client certificate generation.

• ERP Security Alignment: Solid understanding of how S/4HANA consumes identity tokens, specifically CERTRULE, EXTID_DN, and ICM profile parameters (icm/HTTPS/verify_client).