Cyber security engineer for AI platforms

IONOS; Berlin; Ibrido; EUR 90.000 - 130.000; Tempo pieno

Vantaggi offerti da questo lavoro

Гибридная работа

Гибкий график

Служебная столовая

Современные офисы

Корпоративные мероприятия

Descrizione del lavoro

IONOS — ведущий европейский хостинг-провайдер, строим инфраструктуру будущего и обеспечиваем безопасность миллионов клиентов. Ищем специалиста по архитектуре безопасности, который задаёт стандарты и удерживает защиту мультиарендной платформы, включая виртуализацию, контейнеры и IAM.

На должности вы будете определять требования к безопасности, проводить предварительные обзоры развертываний и консультировать инженеров по безопасному внедрению, включая внутренние AI-платформы и агентные решения.

Competenze

• Несколько лет практического опыта в инфраструктурной или платформенной безопасности.
• Глубокие знания Linux, виртуализации, контейнеров и мульти-арендной инфраструктуры.
• Опыт разработки и внедрения стандартов безопасности в разнородной среде, включая IaC.
• Опыт разработки и эксплуатации LLM и агентных систем; умение управлять рисками.
• Свободное владение английским языком; немецкий будет преимуществом.

Mansioni

• Определение и поддержка стандартов архитектуры безопасности для инфраструктуры провайдера.
• Оценка изоляции арендаторов и содействие исправлениям совместно с командами платформы.
• Рассмотрение дизайна инфраструктуры на воздействие на безопасность и участие в инцидент-разборе.
• Консультирование по безопасному принятию решений в внедрении ИИ и агентов; обеспечение контроля действий.
• Определение и соблюдение контроля доступа, аудита и журналирования для внутренних AI-платформ.

Conoscenze

Security architecture

Linux

Virtualization

Containers

IAM

IaC security

Risk assessment

LLM/Agent systems

English fluency

German language

Descrizione del lavoro

Описание:

At IONOS, we do not just manage servers; with our solutions, we shape the digital future for over 6.2 million customers worldwide. As Europe's leading hosting provider and a pioneer in independent cloud solutions, we are building next-generation infrastructure, from sovereign cloud architectures and high-performance GPU clusters to integrated AI automation tools. What drives us: digital freedom of choice for Europe and real impact for SMEs and large enterprises.

Задачи:

Define and maintain security architecture standards and hardening baselines for provider-side infrastructure: virtualization and container platforms, control planes and provisioning systems, DNS, mail infrastructure, and backup and recovery systems. Assess and strengthen tenant isolation across shared hosting, virtualization, and container layers, and drive remediation with the responsible platform teams. Review infrastructure designs and significant changes for security impacts, and act as the escalation point for infrastructure security questions from platform, cloud, and brand engineering teams. Reduce the blast radius on the most critical paths: privileged access to customer-facing infrastructure, administrative segmentation, secrets handling, and recovery integrity—translated into actionable, brand-specific implementation plans for our heterogeneous platforms. Support Cyber Defense, Vulnerability Management, and IT emergency management with infrastructure expertise during incidents and in post-incident reviews and hardening. Take responsibility for the security architecture and baseline standards for internally operated AI platforms: model gateways and self-hosted models, agent frameworks, assistant integrations, connectors, and retrieval pipelines over internal data. Define and enforce how agents are identified, authenticated, and authorized: handling non-human identities, credential and token management, least-privilege access to tools and systems, and determining where autonomous action requires a human in the loop. Determine which data internal AI systems may call and index, and ensure that agent activities are logged, attributable, and reviewable in line with the requirements of our regulatory obligations and certifications. Conduct pre-deployment security reviews for new internal AI platforms and agent use cases in line with the rapid pace of adoption, and oversee unsecured/unsanctioned AI use (Shadow AI). Advise security functions and internal engineering teams on the secure adoption of AI, including the guardrails that enable responsible deployment. Feel comfortable being the only expert in the room on certain issues, prefer fixing root causes over merely documenting findings, and be able to work across security functions and platform teams. Bring a genuine interest in AI systems as engineering artifacts, not just as a policy topic—the practice is still largely emerging, and you will help shape it.

Требования:

Several years of hands-on experience in infrastructure or platform security, ideally at a hosting provider, cloud provider, telecommunications company, or in a comparably large multi-tenant environment. Deep practical knowledge of Linux, virtualization and container platforms, networks, and the security properties of multi-tenant infrastructure. Strong background in Identity & Access: privileged access, machine and workload identities, secrets management, authorization models, and Infrastructure-as-Code security. Experience developing and enforcing security standards in a heterogeneous, partly legacy environment, and gaining acceptance from teams outside your reporting line. Practical knowledge of building and operating LLM and agent systems and their specific risks: prompt injection via untrusted data, overly broad tool access, data exposure through retrieval, unlogged autonomous actions, and model and provider dependencies. Ability to make and defend risk-based decisions—including blocking deployments with a clear rationale—and to explain technical risk clearly to non-technical stakeholders. Fluent English; German language skills are a strong advantage due to our regulatory environment and the public sector.

Будет плюсом:

• Practical experience deploying or securing internal AI platforms, agent frameworks, or tool-calling integrations in a production environment
• Familiarity with NIS2 / BSIG or ISO 27001
• Background in DNS, email infrastructure, or platform-adjacent abuse prevention
• Experience in a multi-brand or post-acquisition environment where the same control must be implemented in different ways
• Background in security engineering or software development (automation, tooling, scripting)

Условия:

• Hybrid working model.
• Flexible working hours through trust-based working time.
• A subsidized canteen at some locations and various complimentary drinks.
• Modern office spaces with excellent transport connections.
• Various employee discounts on activities and products.
• Employee events such as summer and winter celebrations, as well as workshops.
• Numerous training and development opportunities.
• Various health benefits, such as sports and health courses.