YourITeams

DevSecOps and Vulnerability Management Engineer

Brak informacji o wynagrodzeniu

SeniorZdalnieFull-time

#467497·Dodano 8 dni temu·1

Źródło: YourITeams

Aplikuj teraz

Tech Stack / Keywords

GitHub Actions JenkinsAWS CodePipelineArgoCD HelmCVSSEPSSCISA KEVSASTDefectDojo

Podsumowanie oferty

Join a newly formed security team supporting a US-based SaaS platform for public-sector agencies. You will improve CI/CD security and vulnerability management, using tools including GitHub Actions, Jenkins, and AWS CodePipeline, and report risks and progress to senior leadership.

Wymagania

Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.
Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.
Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
Ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.
Ability to coordinate cross-team security remediation and lead technical initiatives during cloud and infrastructure phases.
Comfortable working in environments that use Java, .NET, Node.js, TypeScript, Ruby, and PHP.

Preferred:

Experience with vulnerability aggregation platforms such as DefectDojo.
Container and Kubernetes security expertise.
Knowledge of SBOM and software supply chain security practices, including SLSA and Sigstore.
Familiarity with Azure DevOps or AWS CodePipeline.
Experience building dashboards or security reporting in Power BI or Datadog.

Obowiązki

Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of implemented security scanning tools.
Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
Implement end-to-end vulnerability tracking, ensuring each finding has an assigned owner and documented resolution status: remediated, contained, or risk-accepted.
Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.
Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.
Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.
During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.
Coordinate remediation across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.

Benefity

Outstanding integration trips to various places in Europe.
Luxmed Gold Extended medical care.
Multisport Plus benefit.

Opieka zdrowotna

Karta sportowa

YourITeams

82 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz