Cyber security engineer in cloud

Описание:

For us, security is not a checkbox process added afterwards, but part of our DNA. We build security in where it has an impact: in architectures, pipelines and operating concepts. Evidence should come from ongoing operations, not audit preparation. That is why we are looking for someone who can translate security requirements into robust technical concepts and verify their effectiveness.

Задачи:

• Drive the development and continuous improvement of our Secure SDLC, working directly alongside the dev teams.
• Conduct threat modeling and architecture reviews early in the design phase, not just shortly before release.
• Design modern IAM concepts (role models, authorization logic, recertification processes) and define cryptographic standards and baselines.
• Be responsible for vulnerability and penetration test management: scanning, CVSS assessment, prioritization and remediation tracking.
• Specify logging, monitoring and error-handling requirements and support their implementation.
• Design and evaluate technical business continuity (BC) and recovery tests.
• Automate evidence collection (Compliance as Code) directly in the teams’ CI/CD pipelines.

Требования:

• Several years of solid hands-on experience with Linux and modern cloud infrastructure, including containers, orchestration and networking.
• Practical experience in vulnerability scanning, CVSS assessment and triaging penetration test findings.
• Strong scripting and automation skills (Python, Bash, Infrastructure as Code), ideally already used for automated evidence generation.
• A strong grasp of security design principles and threat modeling.
• Strong consulting and review skills.
• You successfully implement security requirements with dev and ops teams without taking away their technical responsibility.
• SAST, DAST and SCA tooling.
• DefectDojo as a vulnerability management platform; SIEM and monitoring platforms.
• IAM/PAM and PKI (operated by partner teams).
• Deep integration into CI/CD pipelines and ticketing systems for automated evidence generation.
• Fluent German and English (at least C1 level).

Будет плюсом:

• In-depth conceptual knowledge of IAM (role and authorization models, SSO, federation, PAM, recertification logic);
• Practical application of cryptography (TLS, PKI, key management, HSM);
• Knowledge of common frameworks and standards such as ISO/IEC 27001 Annex A, BSI IT-Grundschutz, OWASP ASVS & Top 10, CIS Benchmarks or NIST CSF;
• Exposure to Policy as Code and Continuous Compliance;
• Understanding of audit logic and successful collaboration with external auditors

Условия:

• Hybrid working model with the option to work from home.
• Flexible working hours through trust-based working hours.
• At some locations, a subsidized canteen and various complimentary drinks.
• Modern office spaces with excellent transport links.
• Various employee discounts on activities and products.
• Employee events such as summer and winter celebrations, as well as workshops.
• Numerous training and development opportunities.
• Various health offerings, such as sports and health courses.