IT | OT Security Architect

Stack

Responsibilities

• ▹Design and evolve security architectures across IT, OT, cloud and AI systems
• ▹Design secure cloud and hybrid architectures (Azure, AWS, GCP) including landing zones, identity and network design, encryption and security baselines
• ▹Create target architectures, security roadmaps and migration paths, especially for cloud transformations and multi-cloud scenarios
• ▹Carry out threat modeling, architecture reviews and risk analyses for applications, networks, cloud workloads and platforms
• ▹Design network and perimeter security including segmentation, firewalling and zero trust network access, on-premises and in the cloud
• ▹Design IAM and PAM architectures and cryptography and PKI concepts, including cloud-native identity and key management services
• ▹Assess and secure cloud platform services, container/Kubernetes environments and CI/CD pipelines (DevSecOps)
• ▹Define security requirements for projects, products, cloud providers and service providers
• ▹Translate regulatory requirements (NIS2, DORA, ISO 27001, BSI IT-Grundschutz, BSI C5) into technical specifications and verifiable controls
• ▹Advise CISOs, cloud teams, architecture boards and technical decision makers
• ▹Create security concepts, policies and technical documentation
• ▹Use AI-assisted tools in discovery, architecture reviews and documentation, including expert validation and approval of the results

Requirements

• ▹Confident use of AI tools in consulting work, including critical assessment of the results
• ▹Strong awareness of confidentiality when using AI: knowing which data may go into which system and understanding the risks (data leakage, model training, prompt injection)
• ▹Willingness to continuously develop processes and products with AI
• ▹At least 3–5 years of experience in IT/cyber security, of which several years in architecture or consulting roles
• ▹Broad technology understanding across network, endpoint, identity, application and cloud
• ▹Experience with zero trust and segmentation concepts as well as IAM/PAM (Entra ID, Active Directory)
• ▹Solid command of ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, SABSA/TOGAF
• ▹Knowledge of cryptography, PKI and secure application design
• ▹Business-fluent German and English

Nice to have

• ▹Cloud architecture know-how: design and security of cloud and hybrid environments (Azure, AWS, GCP), cloud-native security services, infrastructure-as-code
• ▹Prompt engineering, AI agents or LLM integration in workflows
• ▹AI governance (EU AI Act, ISO/IEC 42001, OWASP Top 10 for LLM)
• ▹Regulated environments (KRITIS, financial sector, industry/OT)
• ▹Certifications: CCSP (ISC²) or CCSK, Microsoft SC-100 and/or AZ-305, AWS Solutions Architect Professional and/or Security Specialty, Google Professional Cloud Architect or Cloud Security Engineer, CISSP, CISSP-ISSAP, SABSA SCF, TOGAF, CISM, OffSec OSCP

Soft skills

What we offer

• ▹Fixed salary from €80,000 plus profit sharing of up to €70,000
• ▹Flexible working hours, remote work, 30 days of vacation
• ▹IT equipment such as an Apple MacBook
• ▹Regular team events
• ▹Company pension scheme and health insurance, shopping and employee discounts
• ▹Location-independent work

About the company

APT-ONE GmbH is a Berlin-based cyber security consultancy protecting its clients' IT, OT, cloud and AI systems. AI tools handle discovery and routine analysis, while the consultants validate and interpret the results.