Senior DevSecOps Engineer

Overview

We are looking for a Senior DevSevOps Engineer.  

The role maps the operational attack surface while the other seniors assess the applications. It provides a clear view of the cloud, edge, network, and VM estate, with identified gaps ranked for remediation.

About Nortal

We’re Nortal. We think big and create cutting-edge digital solutions with a global reach. And with 25 years of experience, 2,700+ professional experts, and half a billion people worldwide impacted by our work, we believe we’ve got the numbers to back up that statement.

Our global teams have played a significant role in many Fortune 500 companies’ projects and systems and have been the driving force of digital transformation for governments, healthcare institutions, and leading enterprises worldwide. We combine best-in-class strategic consulting with software engineering, data, and design practices to bring our visions to life.

Responsibilities

• Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use
• Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner
• Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed
• Sets branch and repository hygiene rules
• Produces weekly progress reporting for the CISO
• In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team

Qualifications

• Around 6 years in DevOps or platform engineering, with solid DevSecOps experience
• Has built CI/CD security gates on GitHub Actions or Jenkins
• Vulnerability management at scale, including risk-based prioritisation
• Can turn findings data into reporting a non-technical leader trusts

Helpful:

• An aggregation tool such as DefectDojo
• Container and Kubernetes security
• SBOM generation and supply chain security (SLSA, Sigstore)
• Azure DevOps or AWS CodePipeline
• Building dashboards in Power BI or Datadog