Senior Security Engineer (m/f/d)

Mission Brief

You are the guardian and the challenger of our security posture. At Isar Aerospace, the systems that build our rockets and the ground systems that launch them are mission critical, and protecting them takes more than good design. It takes someone who will attack their own work to be sure it holds.

We are looking for a deeply hands-on Senior Security Engineer. You live in the consoles, the rule sets and the code. You own our secure access and network security controls, our endpoint and identity security stack, and our detection content, and you operate them yourself rather than directing from the sidelines. You wear two hats: the Builder who implements and runs the controls that keep us safe, and the Adversary who keeps testing whether those controls and detections actually fire.

This is a senior engineering role with the spirit of an architect. You are expected to design what you operate, not just configure it: pick the pattern, write it down, and make it hold at fleet scale. A versatile engineer with real depth, comfortable switching from a firewall rule set to a detection query to a directory hardening sprint in the same week, and a technical anchor others lean on.

Your Role in Our Space Mission

SASE and Network Security

• Own and operate our SASE platform , including revamping Internet Security policies and redefining Private Access policies.

• Drive firewall security with the network team: own network security engineering and segmentation strategy, analyze rule sets, identify gaps, and see remediation through together with network engineering, who own the devices.

• Coordinate firewall-adjacent controls: IPS, AV, sandboxing and DDoS protection.

• Manage our DNS security and WAF solutions , including our edge and CDN-based protection services.

Security Posture and Hardening

• Apply CIS Benchmarks to raise posture across firewalls, endpoints, our cloud identity platform and our cloud productivity suite.

• Lead the clean-up and hardening of our on-premises and cloud identity directories together with the infrastructure team, then keep both hardened on an ongoing basis.

• Drive our phishing-resistant MFA and privileged access programme, including just-in-time elevation and the remediation of the attack paths we find.

• Own certificate lifecycle and PKI operations: key ceremonies, automated renewal, and input to our post-quantum migration plan.

Detection and Visibility

• Manage and tune our IPS/IDS platforms; write and maintain custom IDS signatures, and operate network sensors for NTA appliances.

• Build and maintain detections in our SIEM and apply MITRE ATT&CK to detection engineering and use-case design in support of the SOC.

• Extend visibility into OT with purpose-built OT monitoring tooling.

• Act as an L3 incident responder for escalated security events, and turn every finding into a fix, a new detection or a hardened configuration.

Security Stack and Automation

• Own our endpoint detection and response, data protection and CASB platforms as their technical owner.

• Script and build internal tooling in PowerShell and Python, so controls and checks run themselves.

Design and Engineering Partnership

• Design what you operate: run threat modeling and attack-path analysis on the systems you own, choose the pattern, and document standards others can execute against.

• Evaluate tooling and support vendor selection and renewal decisions in your domain, with a clear view of what each control costs us and what it buys.

• Embed security with engineering: partner with IT, infrastructure, manufacturing and mission teams to implement and validate controls in their environments across both IT and OT, respecting launch-window and change-freeze constraints and producing the evidence our audits depend on.

Qualification Checklist

• Experience: 10+ years in security engineering, with real ownership of production security tooling, not policy or advisory work.

• Architect Spirit: you can step back from the console, design the target state, write the pattern down, and then go build it yourself.

• SASE: hands-on experience administering an enterprise SASE platform end to end, not just consuming it.

• Hardening: experience applying CIS Benchmarks to firewalls, endpoints, cloud identity and cloud productivity platforms in production, plus experience rolling out phishing-resistant MFA or privileged access management.

• Networking and Firewalls: solid fundamentals, enough to own segmentation strategy and to drive rule set analysis and gap remediation with a network team that owns the devices. Experience with CDN-based WAF and edge protection services.

• Security Stack Depth: strong background across endpoint detection and response, data protection, SIEM and detection query languages, cloud identity and on-premises directory hardening, certificate lifecycle and PKI operations, ideally including a large-scale directory clean-up or remediation effort.

• Detection Engineering: practical MITRE ATT&CK-driven detection work, and experience writing custom IDS/IPS signatures.

• Operational Depth: strong capability in detection, incident response and vulnerability management, with time spent on escalated incidents.

• Automation: scripting ability in PowerShell and Python, plus infrastructure-as-code and policy-as-code experience.

• IT and OT: comfortable working across both. Working knowledge of OT protocols such as EtherNet/IP, OPC UA and Modbus, and familiarity with OT network monitoring, is a strong plus.

• Autonomy: operates with very high autonomy as an internal expert, taking full ownership of their work and guiding others.

• Mentoring: mentors engineers and analysts on the team, and acts as technical lead in cross-functional projects.

• Communication: clear communication and collaboration skills, able to translate technical risk for a range of audiences and to work controls through other teams.

• Education: Bachelor’s or Master’s degree in Computer Science, Information Security, or a related field, or the equivalent through relevant certifications and hands-on experience.

Bonus Skills

• Experience in aerospace, defense, energy, manufacturing or other OT-heavy, safety-critical environments.

• Prior SOC or incident response team experience.

• Cloud security depth in a major public cloud and its native security services.

• Familiarity with industry standards such as ISO 27001 and NIST.

• Relevant certifications, defensive or engineering (e.g., Security+, GCIA) and offensive (e.g., OSCP or equivalent), are both valued.

What We Offer

• Real Ownership: the security tooling that protects a premier European space company is yours to run, rebuild and prove.

• Impact: the opportunity to directly protect the future of spaceflight as we approach our first orbital launch.

• Collaboration: work hand-in-hand with brilliant engineers and IT professionals on genuinely hard problems.

Benefits

• Employee Participation Program: Share in our success through our virtual company share program

• 6 weeks of vacation: Enjoy the days off to relax and recharge

• Subsidised lunch: Stay energised with delicious, subsidised lunches every day

• Relocation support: Benefit from our relocation bonus with deductible expenses up to an agreed amount

• Wellness allowance: Stay healthy and fit with our yearly allowance for wellness activities (e.g., Gym, Massages)

• Individual learning allowance: Grow your skills with an individual learning budget granted after the probation period

• Physical and mental well-being: Access via OpenUp the online support from certified psychologists and lifestyle experts at no cost to you and your family

• And Much More! Discover additional perks and benefits when you join our team.

Who we are

We are Isar Aerospace and we are at the forefront of New Space building a modern space business to enable faster, better and cheaper access to space.

…