About the job
Core
Designing and operating a DevSecOps framework to embed security into the CI/CD pipeline, covering source code, packages, containers, and infrastructure code.
Role type
Senior DevSecOps Engineer (CI/CD Security & Supply Chain)
Builds
Secure CI/CD pipelines, artifact integrity controls, and software supply chain security processes.
Domain
Software Development & Security (DevSecOps)
Required skills
DevSecOps, CI/CD pipeline security, SAST/SCA tools, Container & Kubernetes security, IaC security, SBOM management, Policy as Code, Scripting (Python/Bash/Go), Vulnerability triage
Preferred skills
CD security & artifact signing (SLSA, Sigstore), SBOM standards (SPDX, CycloneDX), Package/Container registry security, Large-scale security process implementation, Cloud & on-prem hybrid environments
Technologies
GitLab CI, Terraform, Kubernetes, Trivy, Grype, Checkov, KICS, tfsec, OPA/Gatekeeper, Kyverno, Nexus, Artifactory, Harbor
Responsibilities
Integrate SAST/SCA/Secret detection and IaC checks into GitLab CI pipelines; Establish artifact integrity and deployment approval workflows; Manage SBOM and CVE impact analysis; Scan container registries for vulnerabilities; Document security policies and SLAs; Monitor security metrics and optimize false positives.
Seniority
Senior, hands-on IC