Senior Cyber Security Engineer (f/m/d) Cloud

IONOS Group; Berlin; Hybrid; EUR 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

Hybrid work model

Flexible hours

Canteen subsidy

Modern office near transport

Employee discounts

Team events

Training & development

Health programs

Zusammenfassung

IONOS Group is seeking a seasoned cybersecurity professional to translate security requirements into resilient technical concepts and verify their effectiveness. You will drive Secure SDLC with Dev teams, lead threat modeling and architecture reviews, and shape IAM concepts with clear cryptographic baselines.

Role requires fluent English and German, strong governance experience across ISO 27001 and IT-Grundschutz, plus a knack for documentation and collaboration with international interfaces.

Qualifikationen

• Multi-year practitioner experience with standardised management systems and certifications in cyber security.
• Two or more certified scopes under ISO 27001, IT-Grundschutz or BSI C5; privacy standards are a plus.
• Experience integrating management systems into daily operations in a technical organisation.

Aufgaben

• Drive evolution of Secure SDLC with development teams.
• Lead threat modeling and architecture reviews to identify risks early.
• Design IAM concepts and define cryptographic standards and baselines.
• Oversee vulnerability and pentest management, CVSS scoring and remediation tracking.
• Specify logging, monitoring, and error handling requirements and review implementations.
• Design and test technical Business Continuity and disaster recovery plans.
• Automate compliance and evidence collection within CI/CD pipelines.

Kenntnisse

Security management

ISO 27001

IT-Grundschutz

BSI C5

English proficiency (C1)

German proficiency (C1)

Policy as Code

Jobbeschreibung

For us, security isn't an afterthought or a checkbox exercise - it's built right into our DNA. We integrate security exactly where it matters most: into our architectures, pipelines, and operational concepts. Compliance evidence is generated naturally from our day-to-day operations, not from stressful last-minute audit prep. We are looking for someone who can translate security requirements into resilient technical concepts and actively verify their effectiveness.

Tasks

• Drive the evolution of our Secure SDLC side-by-side with our dev teams.
• Lead Threat Modeling and architecture reviews - catching risks early in the design phase, not right before a release.
• Design robust IAM concepts (role models, permission logic, recertification) and define clear cryptographic standards and baselines.
• Take charge of vulnerability and pentest management: scanning, CVSS scoring, prioritizing, and tracking remediations.
• Specify requirements for logging, monitoring, and error handling, and review their implementation across the board.
• Design and evaluate technical Business Continuity (BC) and disaster recovery tests.
• Automate compliance and evidence collection directly within the teams' CI/CD pipelines.

Qualifications

• Well-founded, multi-year practitioner's experience with standardised management systems and certifications, attestations in the cyber security area.
• You have practical experience from two or more certified scopes according to ISO 27001, IT-Grundschutz, BSI C5. More ISO management system experience from privacy standards comes as a plus.
• You have multi-year experience with above standards and certifications in a technical organisation, as in the company offers technical products.
• You are burning for modern tool supported, efficient integration of management systems and certification activities into the daily routine of an organisation.
• You love technology, you do not shy away from documentation but would like to structure it as efficiently as possible.
• You convince through your confident and communicative character when achieving goal oriented results with your international and internal interfaces.
• You proficiently lead discussions in English (CEFR C1 or higher). Completely fluent German (C1 CEFR level is a must).

Nice to Have

• Deep conceptual knowledge of IAM (Role/Permission models, SSO, Federation, PAM, recertification logic).
• Practical experience with applied cryptography (TLS, PKI, Key Management, HSM).
• Familiarity with major frameworks (ISO/IEC 27001 Annex A, BSI IT-Grundschutz, OWASP ASVS & Top 10, CIS Benchmarks, NIST CSF).
• Experience with Policy as Code and Continuous Compliance.
• An understanding of audit logic and how to collaborate smoothly with external auditors.

Benefits

• Hybrid working model with home office option.
• Flexible working hours through trust-based working hours.
• At some locations a subsidized canteen and various free drinks.
• Modern office space with very good transport connections.
• Various employee discounts for activities and products.
• Employee events such as summer and winter parties, as well as workshops.
• Numerous training and development opportunities.
• Various health offers, such as sports and health courses.