Cyber Security Engineer (f/m/d) Infrastructure & AI Platform Security

Description

The company hosts services for more than 6.2 million customers worldwide and is a leading hosting provider in Europe.

It is building sovereign cloud architectures, high-performance GPU clusters and integrated AI automation tools for small and medium-sized businesses and large enterprises.

The role covers two areas that come down to one question: which systems can reach the most sensitive infrastructure, and under which controls.

You will own the security architecture for the provider-side infrastructure and act as the expert for the internal AI platforms and agents, keeping them secure, governed and auditable so they do not become a new group of privileged access.

This is a hands-on expert role. You set standards, challenge designs, and help platform and engineering teams across the brands put them into practice.

Responsibilities

• Write and maintain security architecture standards and hardening baselines for provider infrastructure, including virtualization and container platforms, control planes, provisioning, DNS, mail, and backup and recovery.
• Assess tenant isolation across shared hosting, virtualization and container layers, and push fixes through the platform teams that own them.
• Review infrastructure designs and major changes for security impact, and be the escalation point for infrastructure security questions from platform, cloud and brand engineering teams.
• Reduce blast radius where it matters most: privileged access to customer-facing infrastructure, administrative segmentation, secrets handling and recovery integrity. Turn this into implementation plans for each brand that work across different platforms.
• Give infrastructure expertise to Cyber Defense, Vulnerability Management and IT Emergency Management during incidents and in the hardening work that follows.
• Own the security architecture and baselines for the internal AI platforms: model gateways, self-hosted models, agent frameworks, assistant integrations, connectors, and retrieval pipelines over internal data.
• Define how agents are identified, authenticated and authorized, including non-human identities, credential and token management, least-privilege tool and system access, and the autonomous actions that need a human in the loop.
• Decide what data internal AI systems may access and index, and make sure agent activity is logged, attributable and reviewable to the standard that regulatory and certification obligations require.
• Run security reviews before new internal AI platforms and agent use cases go live, at a pace that matches how quickly they are adopted, and track where unsanctioned AI usage is emerging.
• Advise security functions and internal engineering teams on adopting AI safely, including the guardrails that make it defensible.

Requirements

• Several years of hands-on work in infrastructure or platform security, ideally at a hosting provider, cloud provider, telco, or another large-scale multi-tenant environment (ideally).
• Deep practical knowledge of Linux, virtualization and container platforms, networking, and the security properties of multi-tenant infrastructure.
• Strong background in identity and access, including privileged access, machine and workload identity, secrets management, authorization models, and infrastructure-as-code security.
• Experience setting security standards in a heterogeneous, partly legacy landscape and getting them adopted by teams you do not manage.
• Working knowledge of how LLM and agent systems are built and run, and of their specific risks: prompt injection through untrusted data, over-scoped tool access, data exposure via retrieval, unlogged autonomous action, and model or provider dependency.
• Ability to make and defend risk-based decisions, including blocking a deployment with a clear rationale, and to explain technical risk to non-technical stakeholders.
• Fluent English.
• Hands-on experience deploying or securing internal AI platforms, agent frameworks, or tool-calling integrations in production.
• Familiarity with NIS2 / BSIG or ISO 27001.
• Background in DNS, e-mail infrastructure, or abuse-adjacent platform security.
• Experience in a multi-brand or post-acquisition environment where the same control has to be implemented in several different ways.
• Security engineering or development background, including automation, tooling and scripting.
• German: a strong advantage given the regulatory and public-sector environment (strong advantage).

Conditions

Hybrid working model.

Flexible working hours under a trust-based system.

The company welcomes applications from everyone, regardless of gender, nationality, ethnic or social origin, religion, disability, age, sexual orientation or identity, physical characteristics, marital status, or any other factor that is irrelevant under applicable law.

Benefits

• Subsidized canteen and various free drinks at some locations.
• Modern office with very good transport connections.
• Employee discounts on activities and products.
• Employee events, including summer and winter parties and workshops.
• Many training and development opportunities.
• Health offerings such as sports and health courses.