YourITeams

DevSecOps Engineer

140 - 150 PLN/ godz./ godz.B2BB2B (netto)

SeniorZdalnie·WarszawaFull-time·B2B

#467619·Dodano 8 dni temu·3

Źródło: justjoin.it

Aplikuj teraz

Tech Stack / Keywords

DevOpsCVSSEPSSCISA KEVCI/CDSecurityGitHub Jenkins

Podsumowanie oferty

The DevSecOps and Vulnerability Management Engineer will strengthen security across development pipelines, cloud infrastructure, and vulnerability management for a US-based SaaS provider serving public-sector agencies. The role focuses on improving CI/CD security, vulnerability triage and tracking, and reporting to senior leadership, using technologies including GitHub Actions, Jenkins, ArgoCD, and AWS CodePipeline.

Wymagania

Approximately 8+ years of experience in DevOps or platform engineering, with substantial practical DevSecOps expertise.
Proven experience implementing automated CI/CD security gates using GitHub Actions or Jenkins.
Hands-on experience managing vulnerabilities at scale, including aggregation, deduplication, risk-based prioritization, and remediation tracking.
Strong understanding of vulnerability scoring and prioritization frameworks, including CVSS, EPSS, and CISA KEV.
Ability to prepare reliable, concise reporting that communicates risk and progress to senior management and non-technical stakeholders.
Ability to coordinate cross-team security remediation and lead technical initiatives during cloud and infrastructure phases.
Comfortable working in environments that use Java, .NET, Node.js/TypeScript, Ruby, and PHP.

Preferred:

Experience with vulnerability aggregation platforms such as DefectDojo.
Container and Kubernetes security expertise.
Knowledge of SBOM, software supply chain security practices (SLSA, Sigstore).
Familiarity with Azure DevOps or AWS CodePipeline.
Experience building dashboards or security reporting in Power BI or Datadog.

Obowiązki

Assess existing CI/CD pipelines and tools, including GitHub Actions, Jenkins (Groovy), ArgoCD, Helm, and AWS CodePipeline, and evaluate the effectiveness of implemented security scanning tools.
Design and implement a unified vulnerability triage process to consolidate findings, remove duplicates, and prioritize risks using CVSS, EPSS, CISA KEV, and exploitability/reachability indicators.
Implement end-to-end vulnerability tracking, ensuring each finding has an assigned owner and documented resolution status.
Integrate SAST, software composition analysis (SCA), secrets detection, container security, and infrastructure-as-code scanning into CI/CD pipelines, and establish security gates to prevent regression.
Define and enforce branch management and repository hygiene practices to reduce accumulated vulnerabilities and control the growth of security findings.
Produce regular vulnerability management reports and progress metrics for the CISO and senior leadership, including accurate weekly reporting.
During Phase 2, lead cloud and infrastructure engineering activities and vulnerability management operations within the DevOps team.
Coordinate remediation activities across engineering teams and translate technical findings into clear, actionable information for non-technical stakeholders.

Benefity

Integration trips to various places in Europe.
Luxmed Gold Extended medical care.
Multisport Plus benefit.

Spotkania integracyjne

Opieka zdrowotna

Karta sportowa

YourITeams

82 aktywne oferty

Zobacz wszystkie oferty

Aplikuj teraz