Consultant DevSecOps

Project overview

The DevSecOps is responsible for identifying, assessing, and remediating security vulnerabilities within software products. This includes managing dependency updates, analyzing flaws detected by various security testing tools, and automating remediation workflows. The role involves close collaboration with development, DevOps, and Security teams to integrate security best practices and ensure application resilience against emerging threats.

The program aims to manage vulnerabilities throughout the development and deployment pipelines to protect organizational assets, ensure regulatory compliance, and maintain customer trust. It also contributes to the continuous improvement of the security posture by integrating vulnerability management practices into the Software Development Life Cycle (SDLC).

Service Deliverables

Required Expertise

Required Qualifications

• Expertise in regular monitoring, triage, and prioritization of vulnerabilities related to third-party dependencies, libraries, and frameworks.
• Expertise in analyzing security results from SAST, DAST, and SCA tools such as SonarQube, Checkmarx, OWASP ZAP, and Dependabot.
• Expertise in implementing and automating dependency update, vulnerability detection, and remediation processes within CI/CD pipelines and containerized environments like OpenShift.
• Expertise in documenting vulnerability assessments, remediation actions, and compliance evidence using tools like Jira and vulnerability management platforms.
• Expertise in developing and applying secure development guidelines, dependency management standards, and security best practices.
• Expertise in reporting on vulnerability status, remediation progress, and risk trends to stakeholders and security managers.
• Expertise in supporting incident response activities related to critical vulnerabilities, including Zero-Day exploits and high-impact CVEs.
• Expertise in adhering to internal policies and external regulations such as ISO 27001, NIST, GDPR, and SOC 2.
• Mastery of vulnerability detection tools (SAST, DAST, SCA) and dependency management across multiple ecosystems (npm, Maven, pip, NuGet).
• Mastery of scripting and automation (Python, Bash) for integrating security processes into CI/CD workflows.
• Expertise in containerization environments and their security, particularly OpenShift and Docker.
• In-depth knowledge of vulnerabilities (OWASP Top 10, CWE) and the CVSS scoring methodology.
• Mastery of version control systems (Git, GitHub) and issue tracking tools (Jira).
• Experience in implementing security best practices within DevOps pipelines and cloud environments.
• Strong analytical, problem-solving, and investigative skills.
• Minimum of 3 years of experience in application security, vulnerability management, or a related field.
• Mastery of the following tools: SonarQube, Checkmarx, OWASP ZAP, Dependabot.
• Experience with dependency management in ecosystems such as npm, Maven, pip, NuGet, or Go Modules.
• Ability to automate security processes within CI/CD pipelines and container platforms.
• Knowledge of Cloud security principles (AWS, Azure, GCP) and container security practices is appreciated.
• CISSP, OSCP, CEH, or CCSP certifications are an advantage.
• Experience with vulnerability management platforms (Tenable, Qualys, Rapid7) and compliance standards is a plus.

Project details

• Start: flexible
• Duration: > 12 months
• Remote: hybrid
• Location: Paris, France, FR
• Languages: English, French