Senior risk management engineer
2 dni temu
Toruń, Kuyavian-Pomeranian Voivodeship, Polska
Nortal
Pełny etat
Bezpłatnie za pośrednictwem poczty elektronicznej lub Google
Zapisz tę ofertę pracy i uporządkuj wyszukiwanie
Utwórz bezpłatne konto, aby zapisywać oferty pracy, tworzyć alerty i wracać do tego ogłoszenia ze swojego pulpitu nawigacyjnego.
Bezpłatnie za pośrednictwem poczty elektronicznej lub Google
Kontynuując, akceptujesz nasze Warunki & Politykę prywatności.
We are looking for a Senior DevSecOps Engineer. The role maps the operational attack surface while the other seniors assess the applications. It provides a clear view of the cloud, edge, network, and VM estate, with identified gaps ranked for remediation. About Nortal We’re Nortal. We think big and create cutting-edge digital solutions with a global reach. And with 25 years of experience, 2,700+ professional experts, and half a billion people worldwide impacted by our work, we believe we’ve got the numbers to back up that statement. Our global teams have played a significant role in many Fortune 500 companies’ projects and systems and have been the driving force of digital transformation for governments, healthcare institutions, and leading enterprises worldwide. We combine best-in-class strategic consulting with software engineering, data, and design practices to bring our visions to life.
Responsibilities:
Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed Sets branch and repository hygiene rules Produces weekly progress reporting for the CISO In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team
Qualifications:
Around 6 years in DevOps or platform engineering, with solid DevSecOps experience Has built CI/CD security gates on GitHub Actions or Jenkins Vulnerability management at scale, including risk-based prioritisation Can turn findings data into reporting a non-technical leader trusts Helpful: An aggregation tool such as DefectDojo Container and Kubernetes security SBOM generation and supply chain security (SLSA, Sigstore) Azure DevOps or AWS CodePipeline Building dashboards in Power BI or Datadog
Responsibilities:
Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed Sets branch and repository hygiene rules Produces weekly progress reporting for the CISO In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team
Qualifications:
Around 6 years in DevOps or platform engineering, with solid DevSecOps experience Has built CI/CD security gates on GitHub Actions or Jenkins Vulnerability management at scale, including risk-based prioritisation Can turn findings data into reporting a non-technical leader trusts Helpful: An aggregation tool such as DefectDojo Container and Kubernetes security SBOM generation and supply chain security (SLSA, Sigstore) Azure DevOps or AWS CodePipeline Building dashboards in Power BI or Datadog