Software Engineer - Secrets Manager - STACKIT (m/w/d)

Schwarz Digits creates the technological foundation for digital sovereignty in Europe.

As the IT and digital division of the Schwarz Group, we develop and manage the IT infrastructures for the retail divisions Lidl and Kaufland, as well as Schwarz Production and Pre Zero.

At the same time, we operate as an independent provider in the external market to support companies across Europe in their digital transformation.

We bundle our core services in the areas of Cloud, Cyber Security, Data & AI, Communication, and Workspace.

Join us and contribute to digital sovereignty in Europe.

With us, you will work at the intersection of agility and security: You will benefit from fast decision-making processes, enjoy genuine creative freedom in your projects, and be able to build upon the stable foundation of the Schwarz Group.

Our Platform Services domain is dedicated to ensuring the highest levels of security and data sovereignty in the cloud.

We are building and scaling the STACKIT Key Management Service (KMS) and Secrets Manager—a core service responsible for the secure, compliant, and reliable management of cryptographic material and sensitive data.

We are looking for an engineer who understands that in a sovereign cloud, encryption is the ultimate source of truth.

You are someone who prioritizes cryptographic integrity above all else—ensuring every secret is vaulted, every key is rotated, and every operation is auditable.

You will be instrumental in implementing the logic that allows our customers to maintain full control over their data lifecycle through sophisticated key management and automated secrets orchestration.

• Your tasks
• You design and develop our Key Management Service, focusing on secure key generation, lifecycle management (Key Rotation), and high-performance cryptographic operations.
• You implement and optimize complex data flows like Envelope Encryption, managing the relationship between Data Encryption Keys (DEKs) and Key Encryption Keys (KEKs) to provide multi-layered security.
• You develop Kubernetes operators to automate the entire lifecycle of the KMS and Secrets Manager, ensuring the service is self-healing, scalable, and easy to configure.
• You build and maintain robust REST APIs that allow customers to programmatically manage Key Rings, import external keys, and execute signing/verification workflows.
• You take ownership in an "You Build It - You Run It" environment, acting as the bridge between security engineering and SRE.
• You ensure that every cryptographic operation adheres to industry standards (AES, RSA, ECDSA, HMAC) and provides the necessary audit trails for sovereign cloud requirements.

Your profile

• You have a deep enthusiasm for Software Engineering, Applied Cryptography, and Cloud-Native security.
• You actively own the entire software development lifecycle, go and k8s being your bread and butter - K8s operators are preferably a core part of your engineering toolkit.
• You are familiar with— or eager to master—cryptographic algorithms (AES-GCM, RSA-OAEP, ECDSA) and understand the logic behind secure key wrapping and transport.
• You understand that "sovereign" means more than just a location; you understand the auditing and compliance needs of managing secrets in a high-stakes cloud environment.
• You don't just look at code; you understand how data flows through a system, identifying potential bottlenecks in API body sizes or cryptographic overhead to ensure cost-efficiency and performance.
• You enjoy discovering new security standards and are excited about sharing your knowledge with the team.
• Our Tech Stack
• Language: Go
• Orchestration: Kubernetes (Custom Operators)
• Encryption: AES-256, RSA (up to 4096), ECDSA, HMAC
• Environment: Sovereign Cloud, Linux, Git Ops
• #J-18808-Ljbffr