Solution & Infrastructure Security Architect (opens in a new tab)

Joan Technologies Ltd.; Dresden; Hybrid; EUR 110,000 - 140,000; Full time

Job summary

Joan Technologies Ltd. is seeking an experienced Solution & Infrastructure Security Architect to design, implement, and review secure infrastructures for semiconductor-domain environments.

The role emphasizes perimeter and infrastructure security, container security, PKI, and API protections. You will review Python/FastAPI backend code, assess risks, and collaborate across engineering, operations, and customer teams to ensure consistent security architectures.

Qualifications

• 10+ years in security architecture or infrastructure security
• Strong Linux and network security background
• Hands-on with containers (Docker/Kubernetes)
• Experience with PKI, TLS/mTLS, and CI/CD security
• Semiconductor-domain experience preferred

Responsibilities

• Design and review network architectures, trust zones, segmentation, reverse proxies, TLS termination.
• Define security controls for Linux and OCI container environments.
• Secure container runtimes; manage image provenance, secrets, backup, and DR.
• Design and review API authentication/authorization and service-to-service identity.
• Assess OWASP vulnerabilities and conduct risk assessments.
• Coordinate with engineering, operations, and customer teams to ensure secure architectures.

Skills

Security architecture

Network security design

Linux systems

Container security

Python/FastAPI

Threat modeling

OWASP

Cloud/container orchestration

Education

Bachelor's degree in CS/Security

Tools

Docker

Docker Compose

Kubernetes

PKCS#11

SoftHSM

HSMs

EST

TLS/mTLS

Job description

About the Role

Job Title: Solution & Infrastructure Security Architect

Sector / Domain: Cybersecurity, Infrastructure Security, Network Security, PKI, Container Security

Preferred Industry: Semiconductor

Working Model: Work from Client Office – 5 days a week

Employment Type: Full-time deployed at client location

Seniority Level: Senior / Principal

Expected Notice Period: Immediate joiners or candidates available within 15 days preferred

Role Overview

We are seeking an experienced Solution & Infrastructure Security Architect to design, implement, and review secure infrastructure and solution architectures for semiconductor-domain environments.

The role focuses on perimeter and infrastructure security, trust-zone design, IIDC Hub services, connections to message brokers, the IIDC Self-Service Portal, manufacturer PKI, and customer network integrations.

The ideal candidate will have a strong background in network security, Linux-oriented infrastructure, and container runtime environments. This is a design-oriented and hands-on technical role requiring the ability to review and contribute to Python/FastAPI backend and integration code, assess security risks, and ensure secure communication across infrastructure components.

Candidates with experience in semiconductor environments are preferred. The role focuses on infrastructure and solution security rather than deep embedded firmware development.

Key Responsibilities

• Design and review network architectures, trust zones, segmentation strategies, reverse proxies, TLS termination, and OT-IT integrations.
• Define and implement security controls for infrastructure services, Linux systems, and OCI container environments.
• Secure container runtime platforms using Docker, Docker Compose, and Kubernetes.
• Establish container isolation, image provenance, secrets management, backup, and disaster recovery controls.
• Design and review API authentication and authorization, service-to-service identity, tenant isolation, and audit mechanisms.
• Assess and mitigate OWASP-class application and API vulnerabilities.
• Design and manage certificate-based security using X.509, PKI, TLS/mTLS, and EST.
• Review certificate authority operations and key custody mechanisms involving PKCS#11, SoftHSM, or HSM solutions.
• Define security controls for MQTT message brokers, including authentication, authorization, and access control lists (ACLs).
• Establish appropriate database access controls and secure connectivity between infrastructure services.
• Strengthen software supply-chain security through dependency management, Software Bills of Materials (SBOM), artifact signing, and CI/CD security.
• Secure secrets and implement authenticated offline software updates.
• Define logging, monitoring, incident response, and coordinated vulnerability disclosure processes.
• Conduct CRA-related risk assessments and prepare or review technical security documentation.
• Write and review Python/FastAPI backend and integration code, including security-focused tests.
• Review embedded C code sufficiently to validate interfaces and assess integration-related security risks.
• Coordinate with engineering, infrastructure, operations, and customer teams to ensure consistent security architecture and implementation.

Required Skills & Experience

1. Experience and Technical Background

• 10+ years of relevant experience in security architecture, infrastructure security, network security, or a related domain.
• Strong experience in network and infrastructure security design.
• Linux-oriented infrastructure and security experience.
• Hands-on understanding of container runtime environments, including Docker, Docker Compose, and Kubernetes.
• Experience designing security controls for distributed services and infrastructure integrations.
• Semiconductor-domain experience preferred.

2. Network and Infrastructure Security

• Network and trust-zone design.
• Network segmentation and perimeter security.
• Reverse proxy configuration and TLS termination.
• OT-IT integration and secure connectivity between network zones.
• Linux and OCI container hardening.
• Container isolation and image provenance.
• Secrets management, backup, and disaster recovery.

3. Application, API, and Service Security

• API authentication and authorization.
• Service-to-service identity and secure communication.
• Understanding of OWASP-class vulnerabilities.
• Tenant isolation and audit controls.
• Database access control and secure service integration.

4. PKI and Cryptographic Infrastructure

• X.509 certificates and Public Key Infrastructure (PKI).
• TLS and mutual TLS (mTLS).
• Enrollment over Secure Transport (EST).
• Certificate authority (CA) operations.
• Key custody and management using PKCS#11, SoftHSM, or Hardware Security Modules (HSMs).

5. Messaging and Supply-Chain Security

• MQTT broker authentication, authorization, and ACLs.
• Dependency management and SBOM.
• Artifact signing and software supply-chain security.
• CI/CD pipeline security and secrets protection.
• Authenticated offline update mechanisms.

6. Development and Security Governance

• Ability to write and review Python/FastAPI backend and integration code.
• Experience writing and reviewing tests.
• Ability to read embedded C code to validate interfaces.
• Logging, monitoring, incident response, and coordinated vulnerability disclosure.
• CRA risk assessment and technical security documentation.

Desirable Skills & Experience

• Experience with IEC 62443 and industrial cybersecurity.
• Exposure to operational technology (OT) deployments.
• Enterprise PKI and provisioning services.
• BRSKI/MASA-based onboarding and provisioning.
• Secure boot and firmware signing.
• Experience coordinating penetration testing and remediation activities.
• Experience securing semiconductor infrastructure and customer-facing service integrations.

Conclusion – Ideal Candidate Profile

The ideal candidate is a Senior or Principal-level security architect with 10+ years of experience designing and reviewing secure infrastructure and distributed solutions. They should combine strong network and Linux security expertise with practical knowledge of containers, PKI, TLS/mTLS, API security, MQTT, and software supply-chain protection.

The candidate must be comfortable working across architecture, implementation, code review, risk assessment, and security documentation. Strong Python/FastAPI review skills and the ability to validate embedded software interfaces are important. Semiconductor experience is preferred.

This position is primarily focused on solution and infrastructure security, with deep firmware and secure-element implementation outside its scope.

Additional Requirements

• Domain Preference: Semiconductor.
• Technical Focus: Network, Linux-oriented infrastructure, container security, PKI, API security, and secure integrations.
• Out of Scope: Deep firmware development and secure-element implementation.