DevSecOps - CI/CD & Software Supply Chain Security

Project overview

We are currently looking for a "Security Consultant" for one of our clients to secure CI/CD processes and software supply chains in a security-critical environment with segregated network and security zones.

Responsibilities

The assignment is full-time and approximately 95% remote.

• Analysis, evaluation, and hardening of existing build, CI/CD, and delivery processes across multiple security zones
• Design and setup of an artifact lock including mirroring, checking, quarantine, release, and controlled software procurement
• Securing the software supply chain through signing, provenance, SBOMs, and secrets management
• Introduction of automated security scans and Policy-as-Code approaches into existing development and delivery processes
• Implementation in the pilot area and creation of a rollout concept for further teams and zones

Requirements

• Many years of experience with self-operated CI/CD platforms as well as build and deployment processes
• Profound expertise in software supply chain security, artifact management, signing, SBOMs, and secrets management
• Practical experience with security scanning, Policy as Code, and securing development and delivery chains
• Very good knowledge of relevant solutions such as GitLab CI, Jenkins, Harbor, Nexus, Vault, Cosign, Trivy, OPA/Gatekeeper, or comparable tools
• Experience in regulated or security-critical environments as well as in collaboration with development and platform teams
• Willingness to undergo a security check (SÜ2)

Project details

• Start: November
• Duration: 12 Monate
• Location: remote, DE
• Languages: German