Security Engineer (f/m/d)

IONOS Group; Berlin; Hybrid; EUR 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Hybrid working model

Flexible hours

Canteen subsidy

Active employee events

Training and development

Health and wellness programs

Zusammenfassung

IONOS Group is seeking a Senior Security Architect in Berlin to translate security requirements into resilient technical concepts and verify their effectiveness. You will integrate security into architectures, pipelines, and operations, ensuring compliance naturally within daily work.

You will lead threat modeling, IAM design, vulnerability management, and disaster recovery testing, collaborating with international teams. A strong background in ISO/IEC standards is required.

Qualifikationen

• Multi-year practitioner’s experience with standardised management systems and cyber security attestations.
• Experience with ISO 27001, IT-Grundschutz, BSI C5 certifications; privacy standards a plus.
• Proven track record implementing management systems in technical organisations with product teams.
• Strong documentation skills and ability to structure it efficiently.
• Excellent communication with international interfaces; fluent English and German at C1+.

Aufgaben

• Drive the evolution of our Secure SDLC with dev teams.
• Lead Threat Modeling and architecture reviews early in design.
• Design IAM concepts and cryptographic standards.
• Manage vulnerability and pentest activities: scanning, CVSS, remediation tracking.
• Specify logging/monitoring requirements and review implementation.
• Design and test Business Continuity and disaster recovery plans.
• Automate compliance and evidence collection in CI/CD pipelines.

Kenntnisse

Security management

English communication

German communication

Auditing & compliance

Tools

ISO 27001

IT-Grundschutz

BSI C5

OWASP ASVS

NIST CSF

Jobbeschreibung

For us, security isn't an afterthought or a checkbox exercise - it's built right into our DNA. We integrate security exactly where it matters most: into our architectures, pipelines, and operational concepts. Compliance evidence is generated naturally from our day-to-day operations, not from stressful last-minute audit prep. We are looking for someone who can translate security requirements into resilient technical concepts and actively verify their effectiveness.

Tasks

• Drive the evolution of our Secure SDLC side-by-side with our dev teams.
• Lead Threat Modeling and architecture reviews - catching risks early in the design phase, not right before a release.
• Design robust IAM concepts (role models, permission logic, recertification) and define clear cryptographic standards and baselines.
• Take charge of vulnerability and pentest management: scanning, CVSS scoring, prioritizing, and tracking remediations.
• Specify requirements for logging, monitoring, and error handling, and review their implementation across the board.
• Design and evaluate technical Business Continuity (BC) and disaster recovery tests.
• Automate compliance and evidence collection directly within the teams' CI/CD pipelines.

Qualifications

• Well-founded, multi-year practitioner's experience with standardised management systems and certifications, attestations in the cyber security area.
• You have practical experience from two or more certified scopes according to ISO 27001, IT-Grundschutz, BSI C5. More ISO management system experience from privacy standards comes as a plus.
• You have multi-year experience with above standards and certifications in a technical organisation, as in the company offers technical products.
• You are burning for modern tool supported, efficient integration of management systems and certification activities into the daily routine of an organisation.
• You love technology, you do not shy away from documentation but would like to structure it as efficiently as possible.
• You convince through your confident and communicative character when achieving goal oriented results with your international and internal interfaces.
• You proficiently lead discussions in English (CEFR C1 or higher). Completely fluent German (C1 CEFR level is a must).

Nice to Have

• Deep conceptual knowledge of IAM (Role/Permission models, SSO, Federation, PAM, recertification logic).
• Practical experience with applied cryptography (TLS, PKI, Key Management, HSM).
• Familiarity with major frameworks (ISO/IEC 27001 Annex A, BSI IT-Grundschutz, OWASP ASVS & Top 10, CIS Benchmarks, NIST CSF).
• Experience with Policy as Code and Continuous Compliance.
• An understanding of audit logic and how to collaborate smoothly with external auditors.

Benefits

• Hybrid working model with home office option.
• Flexible working hours through trust-based working hours.
• At some locations a subsidized canteen and various free drinks.
• Modern office space with very good transport connections.
• Various employee discounts for activities and products.
• Employee events such as summer and winter parties, as well as workshops.
• Numerous training and development opportunities.
• Various health offers, such as sports and health courses.