Cyber Security Engineer (f/m/d) Infrastructure & AI Platform Security

Description

The company runs a large European hosting and cloud business serving more than 6.2 million customers worldwide, and is building sovereign cloud architectures, high-performance GPU clusters and integrated AI automation tools.

The role covers two areas that share one core question: which systems can reach the most sensitive infrastructure, and under which controls. You will own security architecture for the provider-side infrastructure layer and act as the subject matter expert for the internal AI platforms and agents, so that they stay secure, governed and auditable instead of building up as a new group of privileged access.

This is a hands-on expert position. You set standards, test designs under pressure, and work with platform and engineering teams across the brands to get them built.

Responsibilities

• Define and maintain security architecture standards and hardening baselines for virtualization and container platforms, control planes and provisioning systems, DNS, mail infrastructure, and backup and recovery systems.
• Assess tenant isolation across shared hosting, virtualization and container layers, and push remediation through the platform teams that own them.
• Review infrastructure designs and significant changes for security impact, and serve as the escalation point for infrastructure security questions from platform, cloud and brand engineering teams.
• Shrink blast radius where it matters most: privileged access to customer-facing infrastructure, administrative segmentation, secrets handling and recovery integrity. Turn this into practical per-brand plans that fit each platform.
• Provide infrastructure expertise to Cyber Defense, Vulnerability Management and IT Emergency Management during incidents and in the hardening that follows.
• Own security architecture and baseline standards for the internal AI platforms: model gateways and self-hosted models, agent frameworks, assistant integrations, connectors and retrieval pipelines over internal data.
• Define and enforce how agents are identified, authenticated and authorized, covering non-human identities, credentials and tokens, least-privilege access to tools and systems, and the points where autonomous action needs a human to approve it.
• Set rules for which internal data AI systems may access and index, and make sure agent activity is logged, traceable and reviewable to the level that regulatory and certification duties demand.
• Run security reviews before new internal AI platforms and agent use cases go live, keeping pace with their adoption, and track where unsanctioned AI use is appearing.
• Advise security functions and internal engineering teams on adopting AI safely, including the guardrails that justify that adoption.

Requirements

• Several years of hands-on work in infrastructure or platform security, ideally at a hosting provider, cloud provider, telco or another large multi-tenant environment.
• Solid practical knowledge of Linux, virtualization and container platforms, networking, and the security properties of multi-tenant infrastructure.
• Strong background in identity and access, including privileged access, machine and workload identity, secrets management, authorization models and infrastructure-as-code security.
• Experience setting security standards in a mixed, partly legacy landscape and getting teams you do not manage to adopt them.
• Working knowledge of how LLM and agent systems are built and run, and of their specific risks: prompt injection through untrusted data, over-scoped tool access, data exposure through retrieval, unlogged autonomous action, and dependence on models and providers.
• Ability to make and defend risk-based decisions, including blocking a deployment with a clear rationale, and to explain technical risk to non-technical stakeholders.
• Fluent English. German is a strong advantage given the regulatory and public-sector environment.
• Hands-on experience deploying or securing internal AI platforms, agent frameworks or tool-calling integrations in production.
• Familiarity with NIS2, BSIG or ISO 27001.
• Background in DNS, e-mail infrastructure or abuse-adjacent platform security.
• Experience in a multi-brand or post-acquisition setting where one control has to be implemented in several different ways.
• Security engineering or development background, including automation, tooling and scripting.

Conditions

Hybrid working model.

Flexible working hours based on trust.

Equal opportunity: applications are welcome regardless of gender, nationality, ethnic or social origin, religion, disability, age, sexual orientation and identity, physical characteristics, marital status or other factors irrelevant under applicable law.

Benefits

• At some locations, a subsidized canteen and various free drinks.
• Modern office with very good transport links.
• Discounts on various activities and products.
• Employee events such as summer and winter parties, and workshops.
• Many training and development opportunities.
• Health offers such as sports and health courses.