Sr Manager SAP Security Architect

About the role

This role owns security architecture and design across the Enterprise Solutions portfolio. It defines how the portfolio's platforms - predominantly SAP (S/4HANA, SAP BTP, SAP Business Data Cloud, SAP HANA, Ariba, Fieldglass, Concur, and SuccessFactors), together with the Azure services and the AI and agentic platforms that increasingly surround and extend them - are designed, integrated, and operated securely. Working as a hands-on technical authority within the Enterprise Solutions Architecture team, the role establishes security patterns, identity and access designs, and control standards that every solution in the portfolio is expected to follow, and partners closely with the global cyber team to see those designs safely into production. As the portfolio is modernized and "agentified" - embedding AI copilots and autonomous agents such as SAP Joule into core business platforms - the security expertise this role brings is central to success. Securing agentic AI (how agents authenticate, what data and actions they are authorized for, and how their behavior is governed) is the fastest-growing and highest-stakes area of the portfolio's risk surface. This role is expected to lead that agenda, not merely keep pace with it, and a genuine passion for agentic AI and its secure adoption is essential to the position. The position is an individual-contributor architect role: it leads through technical expertise, influence, and the strength of its designs rather than through direct people management. Although the role has no direct reports, it provides dotted-line technical leadership - defining security architecture, standards, and security-related priorities for the DTECH Enterprise Solutions security team and the Basis team to implement. It does not guide these teams' day-to-day work. It is a trusted advisor to project teams, platform owners, and leadership on how to protect enterprise data and identities across a complex, multi-cloud, SAP-centric estate.

Responsibilities

• Own the end-to-end security architecture for the Enterprise Solutions portfolio - defining reference architectures, security design patterns, and control standards that apply across SAP and non-SAP platforms.
• Produce fit-for-purpose security artifacts (security architecture overviews, high- and low-level designs, and architecture decision records) and review solution designs for security risk before build and deployment.
• Embed security-by-design and zero-trust principles into solution and integration architectures, including data protection, encryption, network segmentation, and secure API/integration patterns (e.g., across SAP BTP Integration Suite and Azure).
• Conduct security and risk assessments, threat modeling, and design reviews; define mitigations and track them to closure with delivery teams.
• Lead security architecture for the AI and agentic platforms that are increasingly embedded across the portfolio - including SAP Joule and other agentic/GenAI capabilities - as SAP and adjacent platforms are modernized and agentified. This is a defining, high-priority dimension of the role.
• Define how AI agents authenticate and are authorized: agent identity, scoped and least-privilege access, delegation and impersonation boundaries, data-access limits, and human-in-the-loop controls for autonomous actions.
• Establish safeguards for prompts, tools, and outputs (e.g., prompt-injection and data-exfiltration defenses) and secure patterns for agent-to-system and agent-to-agent (A2A) interactions across the SAP and cloud estate.
• Set the emerging security standards, guardrails, and