Cyber security engineer in cloud

IONOS; Berlin; Hybrid; EUR 90.000 - 150.000; Vollzeit

Benefits dieser Stelle

Hybrid work model

Flexible hours

Canteen subsidy

Modern office near transit

Employee discounts

Training and development

Zusammenfassung

IONOS ищет специалиста по кибербезопасности для интеграции security в DevSecOps. Вы будете вести разработку и улучшение Secure SDLC, проводить раннее threat modeling и архитектурные обзоры, проектировать IAM-концепции и устанавливать криптографические стандарты.

Кандидат должен владеть Linux, облачными технологиями, навыками автоматизации и опытом управления уязвимостями, а также свободно говорить на немецком и английском языках. Гибридный формат работы в Берлине приветствуется.

Qualifikationen

• Несколько лет практического опыта с Linux и современной облачной инфраструктурой.
• Опыт сканирования уязвимостей, CVSS и triage результатов тестов на проникновение.
• Скриптовые и автоматизационные навыки (Python, Bash, IaC).
• Знания принципов безопасного проектирования и threat modeling.
• Навыки консультирования и проверки вместе с командами разработки и эксплуатации.
• Опыт внедрения требований безопасности в Dev/Ops, использование SAST/DAST/SCA.
• Опыт работы с DefectDojo, SIEM и мониторингом.
• Опыт IAM/PAM и PKI; интеграция в CI/CD; перевод на практику.
• Свободное владение немецким и английским языками (C1).

Aufgaben

• Развивать Secure SDLC в тесном сотрудничестве с командами разработки.
• Проводить threat modeling и архитектурные обзоры на стадии дизайна.
• Проектировать IAM-концепции и определить криптографические стандарты.
• Управлять уязвимостями и тестами на проникновение: сканирование, CVSS, приоритизация.
• Задавать требования к логированию и мониторингу; поддерживать внедрение.
• Разрабатывать BC/восстановление и автоматизировать сбор доказательств.
• Автоматизировать сбор доказательств прямо в CI/CD командах.

Kenntnisse

Linux

Cloud infrastructure

Threat modeling

Scripting

CI/CD

Vulnerability management

IAM

PKI

DefectDojo

SAST/DAST/SCA

Tools

SIEM

DefectDojo

CI/CD tools

Jobbeschreibung

Описание:

For us, security is not a checkbox process added afterwards, but part of our DNA. We build security in where it has an impact: in architectures, pipelines and operating concepts. Evidence should come from ongoing operations, not audit preparation. That is why we are looking for someone who can translate security requirements into robust technical concepts and verify their effectiveness.

Задачи:

• Drive the development and continuous improvement of our Secure SDLC, working directly alongside the dev teams.
• Conduct threat modeling and architecture reviews early in the design phase, not just shortly before release.
• Design modern IAM concepts (role models, authorization logic, recertification processes) and define cryptographic standards and baselines.
• Be responsible for vulnerability and penetration test management: scanning, CVSS assessment, prioritization and remediation tracking.
• Specify logging, monitoring and error-handling requirements and support their implementation.
• Design and evaluate technical business continuity (BC) and recovery tests.
• Automate evidence collection (Compliance as Code) directly in the teams’ CI/CD pipelines.

Требования:

• Several years of solid hands-on experience with Linux and modern cloud infrastructure, including containers, orchestration and networking.
• Practical experience in vulnerability scanning, CVSS assessment and triaging penetration test findings.
• Strong scripting and automation skills (Python, Bash, Infrastructure as Code), ideally already used for automated evidence generation.
• A strong grasp of security design principles and threat modeling.
• Strong consulting and review skills.
• You successfully implement security requirements with dev and ops teams without taking away their technical responsibility.
• SAST, DAST and SCA tooling.
• DefectDojo as a vulnerability management platform; SIEM and monitoring platforms.
• IAM/PAM and PKI (operated by partner teams).
• Deep integration into CI/CD pipelines and ticketing systems for automated evidence generation.
• Fluent German and English (at least C1 level).

Будет плюсом:

• In-depth conceptual knowledge of IAM (role and authorization models, SSO, federation, PAM, recertification logic);
• Practical application of cryptography (TLS, PKI, key management, HSM);
• Knowledge of common frameworks and standards such as ISO/IEC 27001 Annex A, BSI IT-Grundschutz, OWASP ASVS & Top 10, CIS Benchmarks or NIST CSF;
• Exposure to Policy as Code and Continuous Compliance;
• Understanding of audit logic and successful collaboration with external auditors

Условия:

• Hybrid working model with the option to work from home.
• Flexible working hours through trust-based working hours.
• At some locations, a subsidized canteen and various complimentary drinks.
• Modern office spaces with excellent transport links.
• Various employee discounts on activities and products.
• Employee events such as summer and winter celebrations, as well as workshops.
• Numerous training and development opportunities.
• Various health offerings, such as sports and health courses.