Lead Security Consultant CI/CD Freelance Remote

Project overview

For our client, we are looking for a freelancer for the following role / project in full-time and remote:

Lead Security Consultant CI/CD

Securing existing CI/CD pipelines and building a controlled artifact lock for secure software sourcing and artifact transfer between network zones, including isolated on-premises environments.

We are looking for a technically experienced freelancer who will independently take on concept development and implementation.

Responsibilities

Must-haves

Nice-to-haves

Project Outcome

If interested, I need your current CV (in WORD) with your remote hourly rate by Monday, October 12, 2026, EOB.

Additionally, a self-assessment (1=Basic Knowledge / 5=Expert Knowledge) for EACH of the points mentioned above (each line = one rating).

Tolga Yelkenci

Manß & Partner GmbH

*@*.de

• Analysis and hardening of existing CI/CD pipelines and build environments
• Separation of build, release, and delivery rights
• Setup of mirrored registries and package sources for container images, operating system, and language packages
• Implementation of an artifact lock with verification, quarantine, release, and versioning
• Securing software supply chains including SBOM, signing, and provenance
• Integration of automated security scans and Policy as Code
• Implementation of Secrets Management including rotation
• Secure artifact transfer between network zones, even without internet connection
• Technical implementation and validation in pilot operation
• Creation of a rollout roadmap including effort estimation
• 6-10 years of practical experience with CI/CD pipelines and self-operated build infrastructures; pure SaaS experience is not sufficient
• Profound knowledge of GitLab CI, Jenkins, or Tekton
• Experience with hardening existing build and deployment processes
• Setup and operation of mirrored package sources and registries, e.g., Harbor, Nexus, Artifactory, Zot, or Pulp
• Experience with controlled artifact transfers across network and security zones
• Knowledge of transfer methods such as handover gateways, data diodes, or disk-based exchange
• Experience with signing, provenance verification, and own trust anchors without dependency on online services
• Software Supply Chain Security including SBOM (CycloneDX/SPDX), dependency analysis, and vulnerability scanning
• Secrets Management including rotation and replacement of hardcoded credentials
• Automated security checks for source code, container images, and Infrastructure as Code
• Policy as Code, e.g., with OPA/Gatekeeper, Kyverno, or Conftest
• Ability for independent technical implementation and production-near pilot operation
• Very good German language skills, spoken and written
• Experience with Air-Gapped Environments and highly isolated on-premises infrastructures
• Experience with HashiCorp Vault, OpenBao, or SOPS
• Knowledge of Syft, Trivy, Grype, Cosign, Notation, in-toto, or Dependency-Track
• Experience with Semgrep, SonarQube, Checkov, or KICS
• GitOps and declarative deployments with Argo CD or Flux
• Container and Kubernetes security in self-operation
• Experience with regulated environments, separation of duties, and documented release processes
• Experience with licensing and activation procedures in environments without internet access
• Transfer of security procedures from public cloud environments to self-operated infrastructures
• Experience with optimizing security scans and artifact releases regarding throughput and delivery frequency
• Secured CI/CD and build processes
• Functional artifact lock with at least one real zone transition
• Proof of security checks and release processes in pilot operation
• Documented throughput times and rollout roadmap

Project details

• Start: ab sofort
• Duration: 12 Monate
• Location: DE
• Rate: 12-12 EUR/h
• Languages: German