Cyber Security Engineer, Infrastructure and AI Platform Security / Cyber Security Engineer — Infrastructure & AI Platform Security (w/m/d)

Official title: Cyber Security Engineer — Infrastructure & AI Platform Security (w/m/d)

Location: Karlsruhe, Germany — Hinterm Hauptbahnhof 3-5 | Employment information: Hybrid working model; schedule not stated

The engineer is expected to own security architecture for the provider-side infrastructure layer and act as a subject-matter specialist for internal AI platforms and agents. A central objective is to ensure that systems handling sensitive infrastructure remain securely governed instead of creating an accumulating set of privileged access paths.

The role combines standard-setting, detailed design assessment and direct engagement with engineering teams. It covers preventive architecture work, practical remediation with responsible platform teams, and infrastructure expertise for cyber defence, vulnerability management and IT incident-management activities.

Responsibilities

• Define and maintain security architecture standards and hardening baselines for provider-side infrastructure, including virtualisation, containers, control planes and provisioning systems.
• Assess and strengthen tenant isolation across shared-hosting, virtualisation and container layers, driving remediation with responsible platform teams.
• Review infrastructure designs and material changes for security impact and provide escalation support to platform, cloud and brand engineering teams.
• Reduce exposure on critical paths involving privileged access to customer-facing infrastructure, administrative segmentation, secret handling and recovery integrity.
• Translate security requirements into practical, brand-specific implementation plans for heterogeneous platforms.
• Support cyber defence, vulnerability management and IT incident management with infrastructure expertise during incidents and follow-up hardening work.
• Set security architecture and baseline standards for internal AI platforms, agent frameworks, assistant integrations, connectors and retrieval pipelines.
• Define controls for agent identity, authentication, authorisation, credentials, tokens, tool access, data access, logging and human oversight; perform pre-deployment security reviews and advise on secure AI adoption.

Qualifications

• Several years of practical experience in infrastructure or platform security, ideally in hosting, cloud, telecommunications or a comparably large multi-tenant environment.
• Deep practical knowledge of Linux, virtualisation and container platforms, networking, and the security characteristics of tenant infrastructure.
• A strong identity-and-access background covering privileged access, machine and workload identities, secrets management, authorisation models and infrastructure-as-code security.
• Experience developing and enforcing security standards in heterogeneous, partly legacy environments, including building support beyond a direct reporting line.
• Practical knowledge of building and operating LLM and agent systems and their risks, including prompt injection, excessive tool access, retrieval data exposure, unlogged autonomous actions, and model or provider dependencies.
• Ability to make and defend risk-based decisions, including stopping a deployment with a clear rationale, and to explain technical risk to non-technical stakeholders.
• Fluent English. Preferred: German because of the regulatory environment and public-sector context.
• Preferred: production experience deploying or securing internal AI platforms, agent frameworks or tool-calling integrations; familiarity with NIS2, BSIG or ISO 27001; or experience in DNS, mail infrastructure, abuse prevention, multi-brand environments, security engineering or software development.

Skills and Competencies

• Security architecture and hardening-baseline design for complex infrastructure.
• Linux, networking, virtualisation and container-security practice.
• Privileged access, non-human identities, secrets and token management.
• Authorisation models, least-privilege design and infrastructure-as-code security.
• LLM and agent-system security, including guardrails and retrieval-pipeline risk.
• Risk communication, independent judgement and collaboration across security and engineering teams.

Benefits and Employment Information

• Hybrid working model.
• Flexible working hours through a trust-based working-time arrangement.
• Subsidised canteen and complimentary drinks at selected locations.
• Modern office spaces with strong transport connections.
• Employee discounts for activities and products.
• Employee events and workshops.
• Development opportunities and health offerings, including sport and health courses.