Required skills
- CI/CD chains in self-operated installations
- Mirrored package and image sources (container, OS, and language packages)
- Secrets Management including rotation and replacement of stored credentials
- Policy as Code
- Build chains (GitLab CI, Jenkins, Tekton)
- Registry/artifact management (Harbor, Nexus, Artifactory, Zot, Pulp)
- Secrets tools (Vault, OpenBao, External Secrets Operator, SOPS)
- Testing tools (Semgrep, SonarQube, Grype, Checkov, KICS)
- Policy Enforcement (OPA/Gatekeeper, Kyverno, Conftest)
- GitOps (Argo CD, Flux)
Languages: German
Job description
Seeking a Senior DevSecOps Engineer with expertise in Supply Chain Security for a public sector client. The role involves building and implementing secure CI/CD pipelines in isolated environments and focusing on Supply Chain Security and Policy as Code.
Project overview
For our client, we are currently looking for a Senior DevSecOps Engineer (Supply Chain Security) (m/f/d).
a) Framework data:
b) Task description:
Skills
- Duration: 02.11.2026
- 31.12.2027
- Utilization: 100% / Full-time (2,500 hours planned)
- Location: 100% remote
- Industry: Public
- Due to the client's security requirements, the following prerequisites are mentioned:
- Willingness for an extended security check (SÜ2)
- German citizenship
- No staffing from the list of states within the meaning of § 13 Paragraph 1 Number 17 SÜG2
- Setup and independent implementation of pilot secure CI/CD chains in self-operation for isolated zones: mirrored sources, controlled artifact transfer.
- Supply Chain Security and Policy as Code.
- Several years of hands-on experience with CI/CD chains in self-operated installations
- Setup/operation of mirrored package and image sources (container, OS, and language packages)
- Controlled artifact transfer across zone and network boundaries (checking, quarantine, release, data diodes, transfer gateways)
- Signature and origin verification without online services (own trust anchor, own signing)
- Secrets Management including rotation and replacement of stored credentials
- Software Supply Chain Security: dependency analysis, SBOM according to CycloneDX or SPDX
- Automated checks (SAST, dependency/image scanning, IaC scanning) with findings triage and thresholds
- Policy as Code
- Build chains (GitLab CI, Jenkins, Tekton)
- Registry/artifact management (Harbor, Nexus, Artifactory, Zot, Pulp)
- Practical experience with as many of the following secrets tools as possible: (Vault, OpenBao, External Secrets Operator, SOPS); SBOM/signing/provenance (Syft, Trivy, Dependency-Track, Cosign, Notation, in-toto)
- Practical experience with as many of the following testing tools as possible: (Semgrep, SonarQube, Grype, Checkov, KICS); Policy Enforcement (OPA/Gatekeeper, Kyverno, Conftest)
- GitOps (Argo CD, Flux)
Project details
- Start: 02.11.2026
- Duration: 31.12.2027
- Remote: remote
- Location: 53111 Bonn, DE
- Languages: German
Indexed by 9am's meta-search. You are a job provider? Claim or manage this listing
Found on GULP