Identity Security Engineer

Our corporate headquarters in Burgwedel near Hanover – here around 3,000 employees work with full commitment to shape the future of ROSSMANN. Identity is the new security perimeter. ROSSMANN is consistently developing its identity and access landscape – from a classic AD-centric infrastructure to a modern, cloud-capable identity platform with central governance, privileged access management, and zero-trust principles. The focus is on securing identities, reducing attack surfaces, and continuously evolving our security architecture. As an Identity Security Engineer in the Identity Platform team, you take on a key role in this transformation. You design security standards, drive the replacement of legacy technologies, and ensure that our identity platform continues to meet growing requirements for security, compliance, and digital collaboration.

• Hardening and continuous securing of our identity infrastructure in Active Directory and Entra ID – including replacement of legacy protocols in favor of modern methods like OpenID Connect
• Further development and implementation of our AD tiering model and concepts for privileged access (privileged access, local admin rights) in line with our zero-trust strategy
• Design of PAM and PKI landscape from a security perspective: definition of security requirements and hardening specifications, conducting reviews, and participation in architecture and product decisions
• Analysis and assessment of vulnerabilities and misconfigurations in the identity infrastructure and tracking of findings from pentests and audits
• Identification of dependencies on legacy protocols and legacy systems – e.g., through targeted log analyses – and control of their replacement with the responsible technical teams, so that hardening measures can be implemented consistently
• Automation of security checks in the identity infrastructure, e.g., to detect insecure configurations, critical permissions, or use of outdated protocols
• Monitoring current attack techniques on identity systems and deriving appropriate protection and detection measures together with our Cyber Defense Center

• Completed degree in computer science / IT security, vocational training in IT environment, or comparable qualification
• Good knowledge of Active Directory and Entra ID (structure, permission structures, conditional access, group policies, hybrid identity scenarios)
• Confident handling of authentication protocols – from Kerberos and NTLM to modern methods like OpenID Connect (OIDC) and OAuth 2.0
• Understanding of identity security concepts such as tiering and least privilege
• Understanding of PKI and certificate services (e.g., AD CS) as well as privileged access management concepts and their secure integration into identity environments
• Experience in scripting with PowerShell for analysis and automation
• Ideally knowledge of common attack techniques on AD and Entra ID (e.g., Kerberoasting, Pass-the-Hash, ESC vulnerabilities) and appropriate hardening measures
• Structured, independent work style, persistence in following up open items, and enjoyment of cross-team collaboration
• Very good German and good English skills, both written and spoken