cyber security engineer

IONOS provides hosting and independent cloud solutions to more than 6.2 million customers worldwide. It builds infrastructure including sovereign cloud architectures, high-performance GPU clusters, and integrated AI automation tools, serving small and medium-sized businesses and large enterprises.

• Define and maintain security architecture standards and hardening baselines for provider-side infrastructure, including virtualization and container platforms, control planes, provisioning systems, DNS, mail infrastructure, and backup and recovery systems
• Assess and strengthen tenant isolation across shared hosting, virtualization, and container layers, and drive remediation with platform teams
• Review infrastructure designs and major changes for security impact, and serve as an escalation point for infrastructure security questions
• Reduce blast radius for privileged access, administrative segmentation, secrets handling, and recovery integrity by creating per-brand implementation plans across heterogeneous platforms
• Support Cyber Defense, Vulnerability Management, and IT Emergency Management during incidents and post-incident hardening
• Own security architecture and baseline standards for internal AI platforms, including model gateways, self-hosted models, agent frameworks, assistant integrations, connectors, and retrieval pipelines over internal data
• Define and enforce how agents are identified, authenticated, and authorized, including non-human identity handling, credential and token management, least-privilege access, and human oversight of autonomous actions
• Establish which data internal AI systems may access and index, and ensure agent activity is logged, attributable, and reviewable to meet regulatory and certification obligations
• Run pre-deployment security reviews for internal AI platforms and agent use cases, and monitor emerging unsanctioned AI usage
• Advise security functions and internal engineering teams on safe AI adoption and defensible guardrails

• Several years of hands-on experience in infrastructure or platform security
• Deep practical knowledge of Linux, virtualization and container platforms, networking, and multi-tenant infrastructure security
• Strong background in identity and access, privileged access, machine and workload identity, secrets management, authorization models, and infrastructure-as-code security
• Experience designing and enforcing security standards in heterogeneous, partly legacy environments and getting them adopted by teams the candidate does not manage
• Working knowledge of how LLM and agent systems are built and operated, and their specific risks
• Ability to make and defend risk-based decisions, including blocking deployments with a clear rationale, and explain technical risks to non-technical stakeholders
• Fluent English
• Будет плюсом: Hands-on experience deploying or securing internal AI platforms, agent frameworks, or tool-calling integrations in production; familiarity with NIS2 / BSIG or ISO 27001; background in DNS, e-mail infrastructure, or abuse-adjacent platform security; experience in multi-brand or post-acquisition environments; security engineering or development background in automation, tooling, or scripting; German

• Flexible work schedule
• Medical services package from one of two private providers
• 25 Vacation days per year
• Substitute days off for public holidays that occur on weekends
• Meal tickets
• Internal referral program
• Team events, networking events, Summerfest, and Winterfest parties
• Coffee, soft drinks, and fresh fruit at the office