Solution & Infrastructure Security Architect (opens in a new tab) in Dresden

About the Role

Job Title

Solution & Infrastructure Security Architect

Sector / Domain

Cybersecurity, Infrastructure Security, Network Security, PKI, Container Security

Preferred Industry

Semiconductor

Working Model

Work from Client Office – 5 days a week

Employment Type

Full-time deployed at client location

Seniority Level

Senior / Principal

Expected Notice Period

Immediate joiners or candidates available within 15 days preferred

Role Overview

We are seeking an experienced Solution & Infrastructure Security Architect to design, implement, and review secure infrastructure and solution architectures for semiconductor-domain environments.

The role focuses on perimeter and infrastructure security, trust-zone design, IIDC Hub services, connections to message brokers, the IIDC Self-Service Portal, manufacturer PKI, and customer network integrations.

The ideal candidate will have a strong background in network security, Linux-oriented infrastructure, and container runtime environments.

This is a design-oriented and hands-on technical role requiring the ability to review and contribute to Python/Fast API backend and integration code, assess security risks, and ensure secure communication across infrastructure components.

Candidates with experience in semiconductor environments are preferred. The role focuses on infrastructure and solution security rather than deep embedded firmware development.

Key Responsibilities

• Design and review network architectures, trust zones, segmentation strategies, reverse proxies, TLS termination, and OT-IT integrations.
• Define and implement security controls for infrastructure services, Linux systems, and OCI container environments.
• Secure container runtime platforms using Docker, Docker Compose, and Kubernetes.
• Establish container isolation, image provenance, secrets management, backup, and disaster recovery controls.
• Design and review API authentication and authorization, service-to-service identity, tenant isolation, and audit mechanisms.
• Assess and mitigate OWASP-class application and API vulnerabilities.
• Design and manage certificate-based security using X.509, PKI, TLS/m TLS, and EST.
• Review certificate authority operations and key custody mechanisms involving PKCS#11, Soft HSM, or HSM solutions.
• Define security controls for MQTT message brokers, including authentication, authorization, and access control lists (ACLs).
• Establish appropriate database access controls and secure connectivity between infrastructure services.
• Strengthen software supply-chain security through dependency management, Software Bills of Materials (SBOM), artifact signing, and CI/CD security.
• Secure secrets and implement authenticated offline software updates.
• Define logging, monitoring, incident response, and coordinated vulnerability disclosure processes.
• Conduct CRA-related risk assessments and prepare or review technical security documentation.
• Write and review Python/Fast API backend and integration code, including security-focused tests.
• Review embedded C code sufficiently to validate interfaces and assess integration-related security risks.
• Coordinate with engineering, infrastructure, operations, and customer teams to ensure consistent security architecture and implementation.
• Required Skills & Experience
• 1. Experience and Technical Background
• 10+ years of relevant experience in security architecture, infrastructure security, network security, or a related domain.
• Strong experience in network and infrastructure security design.
• Linux-oriented infrastructure and security experience.
• Hands-on understanding of container runtime environments, including Docker, Docker Compose, and Kubernetes.
• Experience designing security controls for distributed services and infrastructure integrations.
• Semiconductor-domain experience preferred.
• 2. Network and Infrastructure Security
• Network and trust-zone design.
• Network segmentation and perimeter security.
• Reverse proxy configuration and TLS termination.
• OT-IT integration and secure connectivity between network zones.
• Linux and OCI container hardening.
• Container isolation and image provenance.
• Secrets management, backup, and disaster recovery.
• 3. Application, API, and Service Security
• API authentication and authorization.
• Service-to-service identity and secure communication.
• Understanding of OWASP-class vulnerabilities.
• Tenant isolation and audit controls.
• Database access control and secure service integration.
• 4. PKI and Cryptographic Infrastructure
• X.509 certificates and Public Key Infrastructure (PKI).
• TLS and mutual TLS (m TLS).
• Enrollment over Secure Transport (EST).
• Certificate authority (CA) operations.
• Key custody and management using PKCS#11, Soft HSM, or Hardware Security Modules (HSMs).
• 5. Messaging and Supply-Chain Security
• MQTT broker authentication, authorization, and ACLs.
• Dependency management and SBOM.
• Artifact signing and software supply-chain security.
• CI/CD pipeline security and secrets protection.
• Authenticated offline update mechanisms.
• 6. Development and Security Governance
• Ability to write and review Python/Fast API backend and integration code.
• Experience writing and reviewing tests.
• Ability to read embedded C code to validate interfaces.
• Logging, monitoring, incident response, and coordinated vulnerability disclosure.
• CRA risk assessment and technical security documentation.

Desirable Skills & Experience

• Experience with IEC 62443 and industrial cybersecurity.
• Exposure to operational technology (OT) deployments.
• Enterprise PKI and provisioning services.
• BRSKI/MASA-based onboarding and provisioning.
• Secure boot and firmware signing.
• Experience coordinating penetration testing and remediation activities.
• Experience securing semiconductor infrastructure and customer-facing service integrations.
• Conclusion – Ideal Candidate Profile

The ideal candidate is a Senior or Principal-level security architect with 10+ years of experience designing and reviewing secure infrastructure and distributed solutions.

They should combine strong network and Linux security expertise with practical knowledge of containers, PKI, TLS/m TLS, API security, MQTT, and software supply-chain protection.

The candidate must be comfortable working across architecture, implementation, code review, risk assessment, and security documentation.

Strong Python/Fast API review skills and the ability to validate embedded software interfaces are important.

Semiconductor experience is preferred.

This position is primarily focused on solution and infrastructure security, with deep firmware and secure-element implementation outside its scope.

Additional Requirements

Domain Preference

Semiconductor.

Technical Focus

Network, Linux-oriented infrastructure, container security, PKI, API security, and secure integrations.

Out of Scope

Deep firmware development and secure-element implementation.