01
TRCI-26-05568
Senior/Principal Security Architect (OT/IT, PKI, Container & Perimeter Security)
Senior/Principal contract role in Munich for a security architect/engineer focused on perimeter and infrastructure security for an IIDC hub and self-service portal, including secure connectivity to a message broker and customer/manufacturer networks. The role requires strong network segmentation and trust-zone design, reverse proxy/TLS termination, OT-IT integration, Linux and container hardening (Docker/Kubernetes), API and service-to-service identity, PKI/X.509 operations (mTLS, EST, CA, PKCS#11/HSM), MQTT authZ/ACLs, supply-chain security (SBOM, signing, CI/CD secrets, offline updates), and operational security (logging/monitoring/IR). Candidate should be able to write/review Python/FastAPI backend code with tests and read embedded C to validate interfaces; experience with CRA risk assessment and technical documentation is required.
Position summary
- Location
- Germany
- Workplace
- On-site
- Employment
- Contract
- Experience
- Minimum 10 years and Maximum 15 years
Role overview
Why This Role Matters.
Senior/Principal contract role in Munich for a security architect/engineer focused on perimeter and infrastructure security for an IIDC hub and self-service portal, including secure connectivity to a message broker and customer/manufacturer networks. The role requires strong network segmentation and trust-zone design, reverse proxy/TLS termination, OT-IT integration, Linux and container hardening (Docker/Kubernetes), API and service-to-service identity, PKI/X.509 operations (mTLS, EST, CA, PKCS#11/HSM), MQTT authZ/ACLs, supply-chain security (SBOM, signing, CI/CD secrets, offline updates), and operational security (logging/monitoring/IR). Candidate should be able to write/review Python/FastAPI backend code with tests and read embedded C to validate interfaces; experience with CRA risk assessment and technical documentation is required.
Your Impact
Deliver Enterprise Value
Help organisations solve complex business problems through modern technology, consulting expertise and measurable outcomes.
Collaboration
Work Across Teams
Collaborate with consultants, architects, engineers and client stakeholders throughout the project lifecycle.
Growth
Learn Continuously
Gain exposure to enterprise technologies, certifications, mentoring and real-world project experience.
Career Path
Grow With Ubique
Build a long-term consulting career with opportunities to take on greater responsibility and leadership over time.
Responsibilities
What You'll Be Doing.
Every role at Ubique contributes directly to solving meaningful business challenges for our clients.
02
Focus: perimeter, infrastructure, IIDC Hub services, connections to message broker, IIDC Self Service Portal, manufacturer PKI and customer networks
03
Network and trust-zone design, segmentation, reverse proxy / TLS termination, OT-IT integration
04
Linux and OCI container hardening, container isolation, image provenance, secrets management, backup and disaster recovery
05
Container runtime environments (Docker, Docker Compose, Kubernetes)
06
API authentication/authorization, service-to-service identity, OWASP-class vulnerabilities, tenant isolation, audit
07
X.509/PKI, TLS/mTLS, EST, CA operation, key custody via PKCS#11 / SoftHSM / HSM
08
MQTT broker authentication/authorization and ACLs, database access control
09
Supply chain: dependency management, SBOM, artifact signing, CI/CD and secret security, authenticated offline updates
10
Logging, monitoring, incident response, coordinated disclosure
11
CRA risk assessment and technical documentation
12
Writes and reviews Python/FastAPI backend and integration code, including tests
Technology stack
Tools & Technologies.
The platforms and technologies you'll use to build modern, enterprise-grade solutions.
01
OT-IT integration
Required
02
trust zones
Required
03
network segmentation
Required
04
reverse proxy
Required
05
TLS termination
Required
06
Linux hardening
Required
07
OCI
Required
08
container hardening
Required
09
container isolation
Required
10
image provenance
Required
11
secrets management
Required
12
backup
Required
13
disaster recovery
Required
14
Docker
Required
15
Docker Compose
Required
16
Kubernetes
Required
17
API authentication
Required
18
authorization
Required
19
service-to-service identity
Required
20
OWASP
Required
Requirements
Skills & Experience.
We value curiosity, collaboration and continuous learning. If you don't meet every requirement but believe you can make an impact, we'd still love to hear from you.
Essential
Required Qualifications
Network and trust-zone design (segmentation, tenant isolation)
Reverse proxy and TLS termination
OT-IT integration
Linux hardening
OCI container hardening and isolation
Container image provenance and artifact integrity
Secrets management
Backup and disaster recovery (DR)
Container runtime environments: Docker, Docker Compose, Kubernetes
API authentication and authorization
Service-to-service identity
OWASP-class vulnerabilities awareness/mitigation
Audit logging and auditability requirements
X.509/PKI fundamentals and operations
TLS/mTLS
EST (Enrollment over Secure Transport)
CA operation
Key custody via PKCS#11
SoftHSM and/or HSM usage
MQTT broker authentication/authorization and ACLs
Preferred
Nice to Have
IEC 62443
OT deployments (industrial/OT environments)
Enterprise PKI / provisioning services
BRSKI/MASA
Secure boot
Firmware signing
Penetration-test coordination
What you'll gain
More Than Just A Job.
We're committed to helping every team member grow professionally, personally and technically while working on meaningful projects.
Global Exposure
Collaborate with international clients and multicultural teams on enterprise programmes.
Continuous Learning
Expand your expertise through mentoring, certifications and hands-on project experience.
Career Growth
Take ownership, develop leadership skills and grow your consulting career over time.
Flexible Working
Hybrid and remote collaboration designed around trust and delivering exceptional outcomes.
People First
Join a supportive culture where collaboration, respect and long-term relationships come first.
Enterprise Projects
Work on meaningful technology initiatives for leading organisations across industries.
Apply
Apply for Senior/Principal Security Architect (OT/IT, PKI, Container & Perimeter Security)
One page, about two minutes. We only ask for what we actually need to have a first conversation.