Security Consultant CI/CD (long term)

Project overview

Key Data:

Role: Security Consultant CI/CD

Period: asap until 31.12.2026 (extension likely until 31.12.2027)

Utilization: Full-time

Project details

mainly remote & on-site as needed nationwide

Service Description

Qualification and Experience Requirements

Must-haves

Should-haves

Have we sparked your interest?

Then send us your CV in Word format and your current availability, including your hourly rate, to: anna.puskaric AT deedcon.de

Sincerely

Anna Puskaric/ Recruiter

• Analysis and evaluation of existing CI/CD, build, and delivery processes, as well as their targeted hardening and further development
• Conception and implementation of secure build and deployment processes across different network and security zones
• Establishment of an artifact lock for the controlled acquisition and transfer of external software and dependencies, including verification, quarantine, release, versioning, and proof of origin
• Establishment and operation of mirrored sources for container images, operating system, and language packages
• Securing the software supply chain through SBOM, signing, origin verification, and own trust anchors
• Implementation of secrets management, including rotation and replacement of credentials stored in the repository
• Integration of automated security checks and Policy-as-Code into CI/CD processes
• Practical implementation of developed concepts in a pilot area, including real zone transition
• Development of a roadmap for subsequent expansion to other development and platform teams
• Min. 6 years of experience with CI/CD pipelines in self-operated or on-premises environments
• Min. 6 years of experience in analyzing, evaluating, hardening, and further developing existing build and delivery chains
• Min. 6 years of experience in establishing and operating mirrored sources for container images, operating system, and language packages
• Min. 6 years of experience with controlled artifact transfers across network or security zone boundaries, including verification, quarantine, and release procedures
• Min. 6 years of experience with transfer methods such as data diodes, transfer gateways, or media-based transfer
• Min. 6 years of experience with signature and origin verification without dependency on online services, own trust anchors, and own signing
• Min. 6 years of experience in secrets management, including rotation and replacement of credentials stored in the repository
• Min. 6 years of experience in Software Supply Chain Security and with SBOM according to CycloneDX or SPDX
• Min. 6 years of experience with automated security checks for code, dependencies, container images, and Infrastructure as Code
• Min. 6 years of experience with Policy as Code for automated enforcement of security requirements
• Min. 6 years of experience in direct collaboration with development and operations teams, including exception and transition regulations
• Min. 6 years of practical experience with tools from several of the following areas:
• CI/CD: GitLab CI, Jenkins, Tekton or similar
• Registry/Artifacts: Harbor, Nexus, Artifactory, Zot, Pulp or similar
• Secrets: HashiCorp Vault, OpenBao, External Secrets Operator, SOPS or similar
• SBOM/Signing: Syft, Trivy, Dependency-Track, Cosign, Notation, in-toto or similar
• Security Testing: Semgrep, SonarQube, Grype, Checkov, KICS or similar
• Policy as Code: OPA/Gatekeeper, Kyverno, Conftest or similar
• GitOps/Deployment: Argo CD, Flux or similar
• Supply chain and signing methods from public cloud environments and their transfer to self-operated infrastructures
• Proof of change and configuration security
• GitOps and declarative deployments across multiple security zones
• Container and Kubernetes security in self-operation
• Separation of duties and network zone models in regulated or security-critical environments
• Handling of tools whose licensing or activation requires an internet connection
• Start: ab sofort
• Duration: 3 Monate
• Remote: remote
• Location: deutschlandweit, Deutschland, DE
• Languages: German