Security Consultant CI/CD (Supply-Chain-Security, Policy as Code) Public I ID-271 I QUINCEY

Project overview

For our client, we are looking for a Security Consultant CI/CD (m/f/d)

Our client, a public institution, is building secure CI/CD pipelines in-house for isolated zones. Key areas include mirrored sources, controlled artifact transfer across zones and network boundaries, supply chain security, and Policy as Code. The implementation will initially be part of a pilot project. The service will be provided entirely independent of location without on-site deployment.

Responsibilities

• Setup and independent implementation of secure CI/CD pipelines in-house for isolated zones (pilot)
• Provision of mirrored sources (package and image sources)
• Implementation of controlled artifact transfer across zones and network boundaries
• Implementation of Software Supply Chain Security
• Implementation of Policy as Code

Requirements

Application:

We look forward to receiving your application with your current CV (in German) and your hourly rate.

For questions, please contact us via Freelancermap or at *@*.io.

Your QUINCEY Team

• Several years of hands-on experience with CI/CD pipelines in an in-house operated installation
• Setup and operation of mirrored package and image sources (container, OS, and language packages)
• Controlled artifact transfer across zones and network boundaries (checking, quarantine, release, data diodes, transfer gateways)
• Signature and origin verification without online services (own trust anchor, own signing)
• Secrets Management including rotation and replacement of stored credentials
• Software Supply Chain Security: dependency analysis, SBOM according to CycloneDX or SPDX
• Automated checks (SAST, dependency/image scanning, IaC scanning) with findings triage and thresholds
• Policy as Code
• Build pipelines: GitLab CI, Jenkins, Tekton
• Registry and artifact management: Harbor, Nexus, Artifactory, Zot, Pulp
• Secrets tools: Vault, OpenBao, External Secrets Operator, SOPS
• SBOM/Signing/Provenance: Syft, Trivy, Dependency-Track, Cosign, Notation, in-toto
• Verification tools: Semgrep, SonarQube, Grype, Checkov, KICS
• Policy Enforcement: OPA/Gatekeeper, Kyverno, Conftest
• GitOps: Argo CD, Flux
• Willingness for security clearance SÜ2
• German citizenship

Project details

10/26/2026

12/31/2027 (with option for extension)

Format: 100% Remote

Client: Client from the public sector

• Start: ab sofort
• Duration: 12 Monate
• Remote: remote
• Location: NRW, Deutschland, DE
• Languages: German