Senior DevSecOps Engineer

We are looking for a Senior DevSecOps Engineer.

The role maps the operational attack surface while the other seniors assess the applications. It provides a clear view of the cloud, edge, network, and VM estate, with identified gaps ranked for remediation.

About Nortal

We’re Nortal. We think big and create cutting-edge digital solutions with a global reach. And with 25 years of experience, 2,700+ professional experts, and half a billion people worldwide impacted by our work, we believe we’ve got the numbers to back up that statement. 

Our global teams have played a significant role in many Fortune 500 companies’ projects and systems and have been the driving force of digital transformation for governments, healthcare institutions, and leading enterprises worldwide. We combine best-in-class strategic consulting with software engineering, data, and design practices to bring our visions to life.

Responsibilities:

• Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use

• Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner

• Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed

• Sets branch and repository hygiene rules

• Produces weekly progress reporting for the CISO

• In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team

Qualifications:

• Around 6 years in DevOps or platform engineering, with solid DevSecOps experience

• Has built CI/CD security gates on GitHub Actions or Jenkins

• Vulnerability management at scale, including risk-based prioritisation

• Can turn findings data into reporting a non-technical leader trusts

Helpful:

• An aggregation tool such as DefectDojo

• Container and Kubernetes security

• SBOM generation and supply chain security (SLSA, Sigstore)

• Azure DevOps or AWS CodePipeline

• Building dashboards in Power BI or Datadog