DevSecOps/ Security Consultant CI/CD - 99% Remote - Freelance

Project overview

Currently, I am looking for a DevSecOps/Security Consultant CI/CD (m/f/d) for an exciting tender for a public client – 99% remote - Freelance

Nice to have

If interested, please send me your current CV with availability and your desired hourly rate (to *@*.com). I will contact you AFTER review and suitability.

Additionally, please let me know how many years of experience you have in each of the MUST criteria.

Feel free to forward this request to your contacts; for successful placement, you will receive a 250€ Amazon voucher from us as a small thank you and of course my eternal gratitude. :-)

I look forward to your feedback and thank you in advance.

Best regards,

Nadine Lobe

Senior Principal Candidate Consultant

*@*.com

*

1st floor, Georg-Glock-Strasse 14, 40474 Düsseldorf

Outpace tomorrow, together

sthree.com

SThree GmbH, Querstraße 7, 60322 Frankfurt, Germany. Register court Frankfurt am Main: HRB 78875, Managing Directors: Niklas Werner, Satinderjeet Sidhu, Daniel Goldthammer. VAT ID: DE252066603

• Experience with supply chain and signing methods from the public cloud environment and their replication with self-hosted means.
• Proof of change and configuration security from within the chain.
• GitOps operating models and declarative deployments in multiple zones.
• Container runtime and cluster security in self-operation.
• Experience with separation of duties in regulated environments and with network zone models.
• Handling tools whose licensing or activation requires a network connection.

Project details

asap, possibly a bit later

Initial contract until the end of the year ++ extension definitely until the end of 2027 thereafter

99% remote - the client is based near Bonn – max. 1 visit per quarter

Contract Type: Freelance

Full-time

Project Language: German - Residence and place of work in Germany required

Budget: 100-110€ / h

PLEASE note the list of states

Position Information / Must Haves:

• Several years of hands-on experience with CI/CD chains in self-hosted installations. Experience based solely on vendor-hosted services does not meet the requirements.
• Analysis and evaluation of existing build processes and their targeted enhancement instead of a new build, where the evaluation supports it.
• Setup and operation of mirrored sources for container images as well as for operating system and language packages as the sole permitted source – including initial population, update cycle, and handling of dependencies that cannot be fully mirrored.
• Controlled transfer of artifacts across zones or network boundaries with verification, quarantine, and release steps; knowledge of common transfer methods including unidirectional coupling via data diodes or transfer gateways and data carrier-based transfer.
• Experience that the acceptance of such a path is determined by its speed, and the ability to design the pace accordingly.
• Signature and origin verification without dependency on online services: own trust anchor, own signing after release, handling of missing revocation and logging services.
• Secrets management including rotation and replacement of credentials stored in the repository.
• Software supply chain security: dependency analysis and bill of materials according to CycloneDX or SPDX.
• Introduction of automated testing tools for static analysis, dependency and image scanning, and declarative infrastructure, including issue triage and threshold setting, so that delivery is not blocked.
• Policy as Code for machine enforcement of requirements.
• Direct collaboration with development teams, including negotiation of exceptions and transition periods.
• Implementation in common tools in this field. The designed concepts and processes are to be realized in the pilot itself, not handed over to third parties for implementation. Therefore, proven practical work with tools from several of the following groups is required – examples given, without pre-selection of a product; equivalent tools are expressly included:
• Build and delivery chains: GitLab CI, Jenkins, Tekton.
• Registry, mirroring, and artifact management: Harbor, Nexus, Artifactory, Zot, Pulp.
• Secrets management: HashiCorp Vault, OpenBao, External Secrets Operator, SOPS.
• Bill of materials, signing, and provenance: SySyft, Trivy, Dependency-Track, Cosign, Notation, in-toto.
• Automated checks: Semgrep, SonarQube, Grype, Checkov, KICS.
• Policy enforcement: OPA/Gatekeeper, Kyverno, Conftest.
• Declarative delivery: Argo CD, Flux.
• Start: ab sofort
• Duration: 3 Monate
• Remote: remote
• Location: meckenheim, Deutschland, DE
• Rate: 110-110 EUR/h
• Languages: German