STACKIT Introduction
STACKIT
STACKIT Security Engineer
Last updated on
STACKIT
STACKIT Security Engineer
A learning path for security engineers: cloud security fundamentals, IAM, Zero Trust networking, secrets management, security operations, and secure software delivery on STACKIT.
STACKIT Introduction
Guide
Advisory stackit university learning stackit overview sovereignty partner
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”An entry-level course that sets up everything else in STACKIT University. It explains STACKIT’s place inside the Schwarz Group and Schwarz Digits, walks through the three pillars behind the sovereign cloud promise — Scalable, Secure, Sovereign — and unpacks what each one actually guarantees in practice, from EU-only data centers to independence from foreign investors. From there it moves into the architecture itself: the IaaS and PaaS layers, how resources are managed through the Portal, API, CLI, and Terraform, and how the 6R framework (rehost, replatform, refactor, repurchase, retain, retire) maps existing workloads onto STACKIT services.
It’s built for anyone who needs a working mental model of STACKIT before going deeper — new customers, new partners, or new hires — so that later courses on the portfolio, portal, or sales don’t have to re-explain the basics. By the end, you’ll be able to place STACKIT correctly against hyperscalers and on-premise alternatives, and know which migration strategy fits a given workload.
What You’ll Learn
Section titled “What You’ll Learn”- Explain STACKIT’s relationship to the Schwarz Group and why that backing translates into financial and operational stability
- Describe what “Scalable, Secure, Sovereign” concretely guarantees — not just the slogan
- Distinguish STACKIT’s IaaS and PaaS layers and know which one a given use case calls for
- Match an existing workload to the right 6R migration strategy
- Navigate the STACKIT Portal, APIs, CLI, and Terraform provider as entry points for managing resources
Modules
Section titled “Modules”- STACKIT and the Schwarz Group
- Mission, Vision, and Core Values
- Key Benefits and Strategic Value
- Big Picture: STACKIT Architecture and Services
STACKIT Portal
Guide
STACKIT Portal
STACKIT
Advisory stackit university learning portal iam onboarding
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”A short, video-centric course that gets you comfortable in the STACKIT Portal: how projects, resources, and IAM tie together, how the interface is laid out, and how to assign users to a project. From there it moves into using the Portal day to day — reading full cost transparency into a project, choosing infrastructure services, and setting up platform services and runtimes — so you leave able to actually operate in the Portal, not just recognize it.
It’s designed as a quick second step right after the STACKIT Introduction course, before diving into the full service portfolio or a specific role path.
What You’ll Learn
Section titled “What You’ll Learn”- Explain STACKIT’s IAM and resource concept and how projects fit together
- Navigate the Portal interface and assign users to a project
- Read cost transparency data and use the cost calculator
- Set up IaaS servers and select infrastructure services in the Portal
- Launch platform services, runtimes, and PaaS components
- Know where to reach STACKIT Support from the Portal
Modules
Section titled “Modules”- Portal Fundamentals
- Portal Services
STACKIT Portfolio
Guide
STACKIT Portfolio
STACKIT
Advisory stackit university learning portfolio overview
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”A guided tour of STACKIT’s portfolio at a glance: what Availability Zones are and how they underpin reliability, how to tell IaaS, PaaS, and SaaS apart and pick the right one, and how cloud-native applications actually run on STACKIT’s runtime offerings. From there it covers modern data and AI services, security and compliance, and the supporting services and interfaces (Portal and APIs) that tie the whole portfolio together.
It’s the third step of the STACKIT Fundamentals path — after the Introduction and the Portal — and gives every other STACKIT University path a shared map of “what exists” before going deep on any one part of it.
What You’ll Learn
Section titled “What You’ll Learn”- Explain what STACKIT is and describe its core portfolio areas
- Understand Availability Zones and how STACKIT ensures reliability and high availability
- Distinguish IaaS, PaaS, and SaaS and know when to use each
- Describe how cloud-native applications run on STACKIT runtime offerings
- Place data, AI, cybersecurity, and critical infrastructure protection within the STACKIT ecosystem
- Get a high-level view of the STACKIT Portal and APIs as interfaces to manage services
Modules
Section titled “Modules”- STACKIT’s Portfolio at a Glance
- Cloud Infrastructure Fundamentals
- STACKIT Services for Application Deployment
- Platform & Developer Experience
- Modern Data & AI Services
- Security & Compliance
- STACKIT Supporting Services
Fundamentals of STACKIT Cloud Security
Guide
Fundamentals of STACKIT Cloud Security
STACKIT
Architecture stackit university learning security compliance sovereignty
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”The entry point into the Security Engineer path: core cloud security concepts and common cloud threats, the Shared Responsibility Model and how security duties split between STACKIT and its customers, and the key design principles behind secure cloud environments. From there it surveys STACKIT’s security services and domains, governance, risk management, and compliance frameworks such as GDPR, and closes with data sovereignty, data classification, and foundational data protection mechanisms.
What You’ll Learn
Section titled “What You’ll Learn”- Explain fundamental cloud security concepts and common cloud threats
- Understand the Shared Responsibility Model between STACKIT and customers
- Describe key security design principles for secure cloud environments
- Understand relevant STACKIT security services and their purpose
- Understand governance, risk management, compliance requirements, and security frameworks
- Explain data sovereignty, data protection, and GDPR compliance
Modules
Section titled “Modules”- Cloud Security Foundations
- Shared Responsibility & Security Principles
- STACKIT Security Architecture & Services Overview
- Governance, Risk & Compliance
- Data Sovereignty & Protection Principles
IAM for Security Engineers
Guide
IAM for Security Engineers
STACKIT
Architecture stackit university learning iam security least privilege service accounts
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”Across four modules, this course examines how identity, authentication, authorization, and access governance work together to secure STACKIT environments. You start with the foundational IAM concepts and how they map onto the platform, then move into the lifecycle of human and machine identities and the authentication mechanisms that verify them, into how access decisions get implemented through roles, permissions, and scope-based authorization, and close with a survey of real IAM attack scenarios, misconfigurations, and the best practices that prevent them.
Most cloud security incidents don’t come from someone breaking through infrastructure defenses — they come from a compromised account, an overprivileged role, or a leaked credential. That makes IAM the security control with the highest leverage in any cloud environment, and the one worth understanding deeply rather than configuring by default. This course is built for security engineers who need to reason about identity risk directly: designing least-privilege access, securing service accounts and programmatic credentials, and knowing what an insecure IAM configuration actually looks like before an attacker finds it.
What You’ll Learn
Section titled “What You’ll Learn”- Understand the full lifecycle of human and machine identities on STACKIT
- Distinguish authentication from authorization and apply each correctly
- Implement secure authentication mechanisms and recommended access methods
- Apply role-based access control and least-privilege principles in practice
- Secure service accounts, credentials, and programmatic access mechanisms
- Recognize overprivileged identities and insecure credential storage before they’re exploited
Modules
Section titled “Modules”- Introduction to IAM
- Identity Management & Authentication
- Access Control & Authorization
- IAM Risks & Best Practices
Network Security & Zero Trust
Guide
Network Security & Zero Trust
STACKIT
Architecture stackit university learning zero trust network security microsegmentation
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”Across four modules, this course builds secure networking foundations on STACKIT, moving from the cloud network threat landscape and defense-in-depth fundamentals through segmentation, Security Groups, and Unified Firewall controls, into secure service exposure with load balancers, TLS, Kubernetes NetworkPolicies, and service mesh technologies. It closes by bringing every building block together into a practical Zero Trust architecture applied to a hybrid STACKIT scenario.
The course is built around dismantling a dangerous but common assumption: “if it’s inside the network, it can be trusted.” Zero Trust rejects that — network location alone never grants trust, and every communication path needs an explicit, documented reason to exist. That reframing matters because it changes how you design from the start: instead of flat networks with broad access, you design for continuous verification, minimal blast radius, and explicit least-privilege connectivity between every workload.
What You’ll Learn
Section titled “What You’ll Learn”- Describe the cloud network threat landscape and defense-in-depth principles
- Use STACKIT Security Group and Unified Firewall to control network access
- Apply segmentation and microsegmentation to isolate workloads and limit lateral movement
- Secure service exposure with load balancers, TLS, and Kubernetes NetworkPolicies
- Design architectures that minimize unnecessary public exposure
- Apply Zero Trust principles, including continuous verification, to STACKIT workloads
Modules
Section titled “Modules”- Network Threat Landscape & Security Fundamentals
- Network Segmentation & Access Control
- Secure Connectivity & Service Exposure
- Zero Trust Architecture in Practice
Secrets Management & Encryption
Guide
Secrets Management & Encryption
STACKIT
Architecture stackit university learning secrets manager kms encryption security
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”Over four modules, this course covers the foundational practices for protecting sensitive data in the cloud: sensitive-data fundamentals and the risks of poor credential handling, secure secret storage using STACKIT Secrets Manager, encryption and key lifecycle management through the Key Management Service (KMS), and Confidential Computing for protecting data while it’s actively being processed.
Encryption at rest and in transit is standard practice, but it leaves a gap most teams don’t think about: data being processed in memory is typically plaintext, readable by anyone with sufficient host, hypervisor, or physical access — including privileged insiders and certain side-channel attacks. This course walks through all three states of data (at rest, in transit, and in use) and shows where Confidential Computing closes that last gap, alongside the everyday discipline of not leaking credentials into application code, logs, or CI/CD pipelines.
What You’ll Learn
Section titled “What You’ll Learn”- Securely store and manage secrets using STACKIT Secrets Manager
- Apply secure credential-handling practices in applications and CI/CD pipelines
- Manage encryption keys and key rotation through STACKIT’s Key Management Service (KMS)
- Reason about data protection across all three states: at rest, in transit, and in use
- Apply Confidential Computing where standard encryption isn’t enough
Modules
Section titled “Modules”- Secrets & Sensitive Data Fundamentals
- Secret Management on STACKIT
- Encryption & Key Management
- Confidential Computing on STACKIT
Container & Kubernetes Security
Guide
Container & Kubernetes Security
STACKIT
Architecture stackit university learning kubernetes security ske supply chain runtime
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”This five-module course covers the security considerations unique to containerized and Kubernetes workloads on the STACKIT Kubernetes Engine (SKE): container security fundamentals, the Kubernetes security model and what it protects, identity and access control for workloads and secrets, network security and cluster hardening, and secure day-to-day operations through audit logging and runtime monitoring.
A recurring theme runs through the course: Kubernetes access control has to be reasoned about at two distinct levels — who can create or modify cloud resources like clusters and Security Groups at the STACKIT platform level, and who can create, read, or modify Pods, Secrets, and RBAC rules inside the cluster itself. These layers are related but not identical, and conflating them is exactly where excessive-permission incidents come from. Sovereignty at the platform layer only holds if it’s matched by equally disciplined access control inside the cluster — this course builds both.
What You’ll Learn
Section titled “What You’ll Learn”- Harden SKE clusters against CIS Benchmarks and Pod Security Standards
- Apply RBAC and least-privilege access at both the platform and cluster level
- Protect Kubernetes Secrets, ConfigMaps, and service account tokens from misuse
- Secure cluster networking and reduce the overall attack surface
- Implement audit logging and runtime security for ongoing operations
Modules
Section titled “Modules”- Container Security Fundamentals
- Kubernetes Security Fundamentals
- Identity, Access & Workload Protection
- Network Security & Cluster Hardening
- Secure Operations on Kubernetes
Security Operations & Threat Detection
Guide
Security Operations & Threat Detection
STACKIT
Architecture stackit university learning security operations threat detection incident response
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”Maintaining a secure cloud environment requires continuous awareness of what’s happening across workloads, services, and user activity. This course introduces the principles and practices of cloud security operations on STACKIT: how security events are identified, analyzed, and addressed to keep cloud resources protected over time.
Across three modules it covers how logging and monitoring establish security visibility on STACKIT, how threat detection and alerting surface potential incidents, and the incident response lifecycle — containment, investigation, and recovery.
What You’ll Learn
Section titled “What You’ll Learn”- Understand the role of logging, monitoring, and observability in cloud security
- Use STACKIT services to improve security visibility
- Identify common security events and indicators of suspicious activity
- Understand the fundamentals of threat detection and alerting
- Explain the incident response lifecycle and key response activities
Modules
Section titled “Modules”- Security Visibility & Logging
- Threat Detection & Alerting
- Security Investigation & Incident Response
Secure Software Development & Application Security
Guide
Secure Software Development & Application Security
STACKIT
Architecture stackit university learning appsec devsecops supply chain
STACKIT
The sovereign European cloud provider behind the framework, delivering IaaS and PaaS from German and Austrian data centers with full digital independence.
Course Overview
Section titled “Course Overview”Security works best when it’s built into the development lifecycle, not bolted on before deployment. This course introduces the principles, practices, and controls that help teams build, deploy, and maintain secure applications on STACKIT — from development workflow through deployment pipeline to production operations.
Across four modules it covers the Secure Software Development Lifecycle (SSDLC) and DevSecOps practices, common application security risks and how to reduce them, how security controls integrate into build and deployment pipelines, and the risks tied to third-party dependencies, container images, and build systems.
What You’ll Learn
Section titled “What You’ll Learn”- Understand the principles of the Secure Software Development Lifecycle (SSDLC)
- Apply secure development practices throughout the software lifecycle
- Understand common application security risks and how to reduce vulnerabilities
- Use STACKIT Git for secure and compliant code management
- Understand how security controls integrate into CI/CD pipelines
- Apply security best practices to Infrastructure as Code (IaC)
- Understand software supply chain security and third-party dependency management
Modules
Section titled “Modules”- Secure Software Development Fundamentals
- Application Security Fundamentals
- Secure Delivery & Deployment
- Software Supply Chain Security
Trail historyActive 4 of the last 12 weeksTMUpdatedNo updates · 1 bar = 1 week i
Maintainers
- TMTobias M.Head of STACKIT Cloud Framework · STACKITOwnerTobias M.Head of STACKIT Cloud Framework · STACKITOwnerActive 12 of the last 12 weeks · 168 updateswww.linkedin.com/in/tobias-müller-011304172
TMTobias M.Head of STACKIT Cloud Framework · STACKITOwnerActive 12 of the last 12 weeks · 168 updatesSTACKITwww.linkedin.com/in/tobias-müller-011304172CC.C1SCF Core · STACKITOwnerActive 5 of the last 12 weeks · 23 updatesSTACKITwww.linkedin.com/in/can-celik-645932315can.celik1@digits.schwarzContributed in STACKIT
Tobias M.Head of STACKIT Cloud Framework · STACKITOwnerActive 12 of the last 12 weeks · 168 updatesSTACKITwww.linkedin.com/in/tobias-müller-011304172CC.C1SCF Core · STACKITOwnerActive 5 of the last 12 weeks · 23 updatesSTACKITwww.linkedin.com/in/can-celik-645932315can.celik1@digits.schwarzContributed in STACKITTobias M.
Tobias M.Head of STACKIT Cloud Framework · STACKITOwnerActive 12 of the last 12 weeks · 168 updatesSTACKITwww.linkedin.com/in/tobias-müller-011304172
· Aug 26, 2026Tobias M.
Tobias M.Head of STACKIT Cloud Framework · STACKITOwnerActive 12 of the last 12 weeks · 168 updatesSTACKITwww.linkedin.com/in/tobias-müller-011304172
· Aug 19, 2026C.C1
C.C1SCF Core · STACKITOwnerActive 5 of the last 12 weeks · 23 updatesSTACKITwww.linkedin.com/in/can-celik-645932315can.celik1@digits.schwarz
· Aug 10, 2026
Show full history (2 more)
C.C1
C.C1SCF Core · STACKITOwnerActive 5 of the last 12 weeks · 23 updatesSTACKITwww.linkedin.com/in/can-celik-645932315can.celik1@digits.schwarz
· Aug 10, 2026C.C1
C.C1SCF Core · STACKITOwnerActive 5 of the last 12 weeks · 23 updatesSTACKITwww.linkedin.com/in/can-celik-645932315can.celik1@digits.schwarz
· Aug 4, 2026