DevSecOps Engineer

Project overview

Description Assignment

As a DevSecOps Engineer, you are the architect and driver of the new, standardized CI/CD pipelines. You design and build modular, 'secure-by-default' building blocks that allow development teams to bring their software to production flexibly and compliantly. You are not only technically responsible for the integration of security controls and quality gates, but you also facilitate the onboarding of teams onto these new platforms. With your coaching skills, you help teams deal with vulnerabilities and automated blockages, and ensure that security becomes a standardized part of the software development process.

Finally, you unlock relevant pipeline data in a secure way to a central dashboard, so that we have continuous integral insight into our security and compliance status.

Technical Skills (Abilities)

Pipeline-as-Code & Modularity: Expertise in building reusable CI/CD components, such as Azure DevOps Templates and GitHub Actions (reusable workflows / composite actions).

Security Tooling Integration: Implementing and configuring GitHub Advanced Security (GHAS) (CodeQL/SAST, Secret Scanning, Dependency Scanning/Dependabot) and any third-party tooling (e.g., SonarQube, Mend, Snyk).

Quality Gates & Governance: Setting up automated quality gates and policy enforcement within the distribution process (break-the-build scenarios).

Data & Dashboarding: Unlocking security and compliance data via APIs (GitHub/Azure DevOps) to a central dashboard (e.g., Power BI, GitHub Insights, or Azure Monitor).

Secret Management & Key Vaults: Integration of pipelines with central vaults (such as Azure Key Vault or HashiCorp Vault).

Software Supply Chain Security (SLSA / SBOM): Understanding how a Software Bill of Materials (SBOM) is generated and certified within GitHub/Azure DevOps to meet modern security requirements.

Vulnerability Management Integration: Ensuring that vulnerabilities from scans on in-production software and SBOM information are provided to Vulnerability Management tooling.

Nice to have

Container & Artifact Security: Scanning container images and third-party packages in registries (such as Azure Container Registry or GitHub Packages) before they go to production.

Infrastructure as Code (IaC) Security: Scanning cloud configurations (Terraform, Bicep, ARM templates) within modules using tools like Trivy or Checkov, as modern pipelines often also deploy infrastructure.

Knowledge (Background & Expertise)

CI/CD Platforms: In-depth knowledge of Azure DevOps and GitHub, including the synergy and migration paths between both platforms.

Secure Development & OWASP: Broad knowledge of application security, secure coding practices, and the OWASP Top 10 / ASVS.

Techstack Diversity: Knowledge of diverse software architectures, ranging from traditional code (Java, .NET, JS) to low-code platforms and cloud-native infrastructures.

Compliance & Frameworks: Knowledge of automated compliance (Compliance-as-Code) and how security controls map to standards such as ISO27001, SOC2, or internal audit tooling.

False-Positive Management: Setting up processes for triaging and suppressing 'noise' (false positives) in GHAS, to prevent teams from ignoring the alerts (alert fatigue).

Desired Capabilities (Competencies & Role Behavior)

Modular & Conceptual Thinking: Designing reusable, scalable, and 'secure-by-default' building blocks that are flexibly deployable for various tech stacks (including low-code).

Change Power & Facilitation: Guiding and enthusing teams during the onboarding process, with attention to the specific needs per team or tech stack.

Coaching Ability: Supporting developers with 'shift-left' security, teaching them how to deal with vulnerabilities and blocking quality gates without losing velocity.

Analytical & Dashboard-Driven: Translating decentralized pipeline data into central compliance insights for the central security dashboard.

Project details

• Start: 2026-10-12T22:00:00
• Location: Rotterdam Zuid-Holland, NL
• Languages: Dutch