Consultant DevsecOps / AppSec

Project overview

We are looking for a DevSecOps / AppSec Consultant for a 6-month renewable mission in Paris 13th.

Technical Skills

Language Skills

Detailed Description

The DIS-SCV-CCA team is responsible for application security (AppSec). Its mission is to support IT departments in securing their projects and to raise awareness/coach developer communities on secure development practices.

As part of a cross-functional program to rationalize and modernize its continuous integration (CI) and source code management tools (migration of thousands of Jenkins/Bitbucket projects to GitLab, Groupe BPCE is building its new software factory.

The main objective of the mission is to integrate, automate, and industrialize security tools and processes within this new CI/CD chain, in the form of reusable templates at the Group level.

• GitLab CI/CD
• Expert
• Mandatory
• Application Security (AST)
• DevOps & SDLC Ecosystem
• Security-as-Code Culture
• Confirmed
• Important
• Professional English (Mandatory)

Responsibilities

Integrated into the Software Factory team on behalf of Application Security, your main tasks will be:

Design and Industrialization of Security (Shift Left):

Support and Assistance to Projects:

Maintenance and Improvement:

Profile and Skills Sought

Essential Technical Skills (Hard Skills):

Transverse Skills (Soft Skills):

• Build and package the "Application Security" service offering in the form of standardized GitLab CI templates reusable by all group projects.
• Integrate continuous security control tools (SAST, DAST, SCA, secrets detection) directly into the GitLab workflow.
• Ensure the articulation and traceability of CI security results (GitLab) to deployment and orchestration tools (XL Deploy, XL Release).
• Help the group's development teams adopt these new templates and integrate security into their sprints (managing false positives, remediation).
• Write technical documentation, integration guides, and security best practice sheets for developers.
• Configure, test, execute, and monitor security pipelines to ensure their performance and that they do not unduly block build chains (optimization of execution times).
• GitLab CI/CD Expertise: Proven experience in creating complex, managed, and shared CI/CD templates at the scale of a large company (include mechanisms, component catalog, CI variables, etc.).
• Application Security Tools (AST): Operational practice of market solutions, particularly Checkmarx (SAST/SCA), Qualys WAS (DAST) or equivalents, and their integration via API or CLI into pipelines.
• DevOps & SDLC Ecosystem: Good command of the legacy and target environment: GitLab, Jenkins, Bitbucket, XL Deploy, XL Release.
• Security-as-Code Culture: Ability to translate security compliance requirements into code and automated configurations.
• Pedagogy and Communication: Ability to simplify security topics for developers and to lead coaching sessions.
• Collaborative Spirit: Pivotal role between the Application Security team (DIS-SCV-CCA) and the Software Factory team.
• Rigor and Writing: Ability to produce clear, structured, and easily actionable documentation.

Project details

• Start: 2026-10-19
• Duration: 6 mois (renouvelables)
• Location: 75013 PARIS, FR
• Languages: French