Cyber security engineer

IONOS; Berlin; Hybrid; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Hybrid work

Flexible hours

Canteen subsidy

Transport benefits

Training & development

Health offerings

Job summary

IONOS приглашает эксперта по безопасности инфраструктуры для определения и поддержки стандартов архитектуры и защиты критических систем. Ваша роль охватит управление безопасностью виртуализации, контейнеров, Identity & Access и IaC, а также участие в обеспечении безопасного функционирования внутренних AI-платформ и процессов устранения инцидентов.

Требуется опыт в многоанендной среде, знание Linux и сетей, умение объяснять риски не техническим стейкхолдерам и готовность работать в гибридном

Qualifications

• Несколько лет практического опыта в инфраструктурной или платформенной безопасности.
• Глубокие знания Linux, виртуализации, сетей и безопасности многоарендной инфраструктуры.
• Опыт работы с Identity & Access, Secrets Management и IaC-секурити.
• Опыт разработки и внедрения стандартов безопасности в разнородной среде.

Responsibilities

• Определение и поддержание стандартов безопасности архитектуры и базовых уровней защиты.
• Оценка дизайна инфраструктуры на предмет влияния безопасности и эскалация вопросов.
• Снижение риска в ключевых сценариях и внедрение планов по улучшению безопасности.
• Поддержка функций Cyber Defense, Vulnerability Management и IT-аварийного реагирования.

Skills

Linux

Virtualization

Container platforms

Identity & Access

Security architecture

Infrastructure-as-Code security

Risk assessment

Scripting/Automation

Networking

Tools

Kubernetes

DNS security

Cloud platforms

Job description

Описание:

At IONOS, we not only manage servers; with our solutions, we shape the digital future for over 6.2 million customers worldwide. As Europe's leading hosting provider and a pioneer in independent cloud solutions, we are building next-generation infrastructure. Both halves of this role revolve around the same fundamental question: which systems can reach our most sensitive infrastructure and under what controls.

Задачи:

Define and maintain security architecture standards and hardening baselines for provider-side infrastructure: virtualization and container platforms, control planes and provisioning systems, DNS, email infrastructure, and backup and recovery systems. Assess and strengthen tenant isolation across shared hosting, virtualization and container layers, and drive remediation with the responsible platform teams. Review infrastructure designs and major changes for security impact, and act as the escalation point for infrastructure security questions from platform, cloud, and brand engineering teams. Reduce the blast radius on the most important paths: privileged access to customer-facing infrastructure, administrative segmentation, secrets management, and recovery integrity — translating these into actionable, brand-specific implementation plans for our heterogeneous platforms. Support Cyber Defense, Vulnerability Management, and IT emergency management with infrastructure expertise during incidents and in follow-up and hardening work. Own the security architecture and baseline standards for internally operated AI platforms: model gateways and self-hosted models, agent frameworks, assistant integrations, connectors, and retrieval pipelines over internal data. Define and enforce how agents are identified, authenticated, and authorized: handling non-human identities, credential and token management, least-privilege access to tools and systems, and determining where autonomous actions require a human in the loop. Determine which data internal AI systems may call and index, and ensure that agent activities are logged, attributable, and auditable in accordance with our regulatory obligations and certifications. Conduct pre-deployment security reviews for new internal AI platforms and agent use cases in line with the rapid pace of adoption, and oversee unsecured or unsanctioned AI use (Shadow AI). Advise security functions and internal engineering teams on the safe adoption of AI, including the guardrails that enable responsible adoption.

Требования:

• Several years of hands-on experience in infrastructure or platform security, ideally at a hosting provider, cloud provider, telecommunications company, or in a comparably large multi-tenant environment.
• Deep practical knowledge of Linux, virtualization and container platforms, networks, and the security properties of multi-tenant infrastructure.
• Strong background in Identity & Access: privileged access, machine and workload identities, secrets management, authorization models, and Infrastructure-as-Code security.
• Experience developing and enforcing security standards in a heterogeneous, partly legacy environment, and gaining acceptance from teams outside your own reporting line.
• Practical knowledge of building and operating LLM and agent systems, and their specific risks: prompt injection through untrusted data, overly broad tool access, data exposure through retrieval, unlogged autonomous actions, and model and provider dependencies.
• Ability to make and defend risk-based decisions — including blocking deployments with a clear rationale — and to explain technical risk clearly to non-technical stakeholders.
• Fluent English; German language skills are a strong advantage due to our regulatory environment and the public sector.
• Someone who is comfortable being the only expert in the room on certain topics, prefers fixing root causes to merely documenting findings, and can work across security functions and platform teams.
• You should have a genuine interest in AI systems as engineering artifacts, not just as a policy topic — much of this practice is only now emerging, and you will help shape it.
• Будет плюсом: Hands-on experience deploying or securing internal AI platforms, agent frameworks, or tool-calling integrations in a production environment;
• Familiarity with NIS2 / BSIG or ISO 27001;
• Background in DNS, email infrastructure, or platform-adjacent abuse prevention (Abuse);
• Experience in a multi-brand or post-acquisition environment where the same control must be implemented in different ways;
• Background in security engineering or software development (automation, tooling, scripting)

Условия:

Hybrid working model. Flexible working hours through trust-based working time. At some locations, a subsidized canteen and various complimentary drinks. Modern office spaces with excellent public transport connections. Various employee discounts for activities and products. Employee events such as summer and winter celebrations, as well as workshops. Numerous training and development opportunities. Various health offerings, such as sports and health courses.