Principal/Lead Network Engineer — SAP RISE

Cencora•Conshohocken, PA

1d•Onsite

About The Position

We are seeking a Principal/Lead Network Engineer — SAP RISE to serve as the senior technical leader and architect responsible for designing, implementing, and operationalizing the enterprise network infrastructure that will enable the migration of Cencora's SAP environment from on-premises data centers to SAP RISE. This is a program-critical role: SAP is the backbone of our supply chain, and the network is the foundational layer that determines the performance, availability, and security of the migrated workloads. You will own the end-to-end network architecture — from private connectivity into Azure, through the SAP RISE managed environment, and back to on-premises users, distribution centers, and integrated systems — ensuring that latency, throughput, redundancy, and security requirements are met at every stage of the migration journey. The ideal candidate combines deep Azure networking expertise with an understanding of SAP application network dependencies and the executive presence to drive decisions across a complex, multi-stakeholder program. Primary Focus: Enterprise network architecture for SAP RISE on Azure migration, hybrid connectivity design, application-aware network optimization, strategic technology leadership, and cross-functional program execution.

Requirements

Bachelor’s or Master’s degree in computer science, information systems, business administration, or another related field.
10+ years of experience in progressively senior network engineering roles.
Deep expertise in networking, including cloud networking, SD-WAN, cybersecurity, and enterprise architecture.
Leadership certifications or experience (e.g., TOGAF, ITIL, PMP).
Exceptional communication and leadership skills for engaging with stakeholders and leading teams.
Requires experience in managing teams and building relationships with people at a variety of levels.
Requires demonstrated ability to launch and deliver one or more IT project(s) on time and within budget.
Demonstrated “hands on” experience working in large-scale environments and tweaking business processes to support growth and productivity.
Demonstrated ability to lead change, able to take calculated risks and seek continuous improvement.
Ability to communicate effectively both orally and in writing; ability to communicate with customers, associates and management; solid teamwork and interpersonal skills.
Strong presentation skills; ability to present and discuss strategies and technical information in a manner that establishes rapport, persuades others, and gains understanding.
Ability to establish solid relationships with vendors in support of initiatives; ability to negotiate and manage outside vendors against deliverables.
Solid project management skills including the ability to effectively deploy resources and manage multiple projects of various diverse scopes in a cross-functional environment.

Responsibilities

Design the end-to-end network architecture that connects Cencora's on-premises data centers, corporate offices, distribution centers, and cloud environments to the SAP RISE on Azure managed infrastructure — ensuring the architecture meets SAP's stringent latency, bandwidth, and availability requirements.
Architect Azure network topology — design and implement Azure Virtual Networks (VNets), hub-and-spoke or Azure Virtual WAN (vWAN) topologies, network security groups (NSGs), route tables (UDRs), Azure Firewall / NVA placement, and private DNS zones to support the SAP RISE landing zone.
Design private connectivity between Cencora's data centers and Azure — leveraging Azure ExpressRoute (with appropriate SKUs, peering configurations, Global Reach, and redundancy models) and/or site-to-site VPN as backup, ensuring sufficient bandwidth and sub-millisecond failover for mission-critical SAP traffic.
Implement SAP RISE cross-VNet / cross-tenant connectivity — architect the network peering, private endpoint, or VNet injection models required to connect Cencora's Azure subscription with the SAP-managed RISE tenant, in collaboration with SAP's RISE delivery team and in accordance with SAP's reference architecture.
Optimize network performance for SAP workloads — design traffic engineering strategies that ensure SAP GUI, Fiori, RFC/BAPI, IDoc, BW, and database replication traffic meets latency and throughput SLAs; leverage Azure proximity placement groups, accelerated networking, and ExpressRoute FastPath where applicable.
Architect hybrid DNS resolution — design DNS forwarding and private DNS zone strategies that enable seamless name resolution between on-premises systems, Cencora Azure resources, and the SAP RISE environment.
Design secure network segmentation — implement micro-segmentation, NSG policies, Azure Firewall rules, and private endpoints to ensure SAP workloads are isolated from general-purpose cloud traffic and compliant with Cencora's security standards and regulatory requirements (HIPAA, SOX).
Plan and implement network connectivity for SAP integration points — ensure network paths are optimized and secured for critical SAP integrations including: SAP-to-SAP interfaces (e.g., S/4HANA to BW/4HANA, SLT, CPI/BTP), SAP-to-third-party integrations (EDI partners, banks, logistics carriers), SAP-to-on-premises systems (legacy middleware, file shares, print services), SAP Fiori / Web Dispatcher access for end users across offices and distribution centers, Basis team remote administration and SAP Solution Manager connectivity.
Design for high availability and disaster recovery — architect geo-redundant ExpressRoute circuits, Azure Availability Zone-aware network topologies, and cross-region DR network connectivity aligned with SAP RISE SLAs and Cencora's business continuity requirements.
Develop phased network migration plans aligned with the broader SAP RISE migration waves — ensuring that network readiness (connectivity, DNS, firewall rules, routing) is validated and operational ahead of each SAP workload migration wave.
Build and manage proof-of-concept (PoC) and pilot network environments — stand up pre-production network connectivity to the SAP RISE environment for early testing, performance benchmarking, and integration validation.
Define and execute network acceptance criteria — establish latency, throughput, packet loss, and failover benchmarks for each migration wave; design and run network performance tests (iPerf, SAP NIPING, traceroute analysis) to validate readiness prior to go-live.
Author detailed cutover run-books for each migration wave — documenting routing changes, DNS cutovers, firewall rule activations, ExpressRoute circuit transitions, and rollback procedures.
Lead network war-room activities during go-live weekends — serve as the network command authority, coordinating with SAP Basis, application, security, and infrastructure teams to troubleshoot and resolve connectivity issues in real time.
Manage the decommissioning of legacy network paths — plan and execute the retirement of on-premises data center network infrastructure (firewall rules, load balancer VIPs, WAN routes, dedicated circuits) that supported the prior SAP hosting model, post-migration.
Serve as the single accountable network leader for the SAP RISE migration program — own the network workstream in the program governance structure, report status to the program steering committee, and manage network-related risks, issues, and decisions.
Collaborate with SAP and SAP RISE delivery teams — act as Cencora's primary network technical interface with SAP's RISE infrastructure team, aligning on shared responsibilities per the SAP RISE operating model and the customer/provider responsibility matrix (RACI).
Partner with Azure cloud architects, security, and infrastructure teams to ensure the SAP network architecture is consistent with Cencora's broader Azure landing zone strategy, cloud governance policies, and zero-trust security framework.
Engage with Cencora's SAP Basis, functional, and development teams to understand application-level network dependencies, performance sensitivities, and integration requirements — translating them into concrete network design decisions.
Lead vendor and carrier coordination — manage relationships with ExpressRoute providers, MPLS/SD-WAN carriers, and Azure support to ensure circuit provisioning, capacity upgrades, and SLA commitments are in place for go-live.
Define network governance and operational standards for the SAP RISE environment — including change management procedures, monitoring/alerting thresholds, incident response playbooks, and capacity management processes for ongoing operations post-migration.
Drive adoption of network automation and infrastructure-as-code — leverage Terraform, Bicep, or ARM templates to codify Azure network configurations, ensuring repeatability, version control, and auditability across migration waves.
Provide technical leadership and mentorship to network engineers supporting the program, fostering skill development in Azure networking, ExpressRoute, and SAP network architecture.