Jobs → Engineering → SAP BTP Platform & Security Engineer

About the Role We are seeking a Senior SAP BTP Platform & Security Engineer to join our team. This role focuses on architecting and provisioning SAP BTP infrastructure while ensuring secure connectivity and identity management. Key Responsibilities • Architect and provision SAP BTP infrastructure and core services • Establish enterprise identity trust between corporate identity providers and SAP backends • Design and maintain secure SAP Cloud Connector environments • Implement end-to-end Principal Propagation for secure SAP S/4HANA integration • Ensure enterprise security and connectivity architecture supports SAP Joule and agentic AI deployments Requirements • 7+ years of experience with minimum 3+ years dedicated SAP BTP experience • Expert-level knowledge of SAP BTP Cockpit, Entitlements Management, Service Keys, Destination Service, and Connectivity Service • Hands-on experience architecting and provisioning SAP BTP subaccounts and multi-environment runtimes (Cloud Foundry and Kyma) • Experience with SAP AI Core, Joule Studio, and Destination Service • Strong expertise in SAP Cloud Identity Services (IAS/IPS) configuration and administration • Experience integrating Microsoft Entra ID, Okta, and SAP backends as enterprise identity providers • Strong understanding of Global User ID management and zero-trust identity architecture • Hands-on experience with SAP Cloud Connector (SCC), including mTLS, High Availability clusters, and System CA certificate automation • Experience configuring BTP Destinations and Principal Propagation using X.509 Certificate Injection and OAuth2SAMLBearerAssertion • Experience supporting on-premise/PCE and public cloud connectivity • Strong knowledge of SAML 2.0, OpenID Connect (OIDC), and OAuth 2.0 authentication flows • Experience with dynamic, short-lived X.509 client certificate generation • Strong understanding of end-to-end token exchange and authorization propagation • Experience collaborating with S/4HANA Basis and Security teams • Knowledge of STRUST, CERTRULE, EXTID_DN, and ICM profile parameters, including icm/HTTPS/verify_client