About the role
The Cyber Resilience Act and NIS2 supply-chain duties mean clients now ask how software was built, not only whether it works. Our delivery teams need pipelines that produce evidence by default. In this role you design and maintain secure CI/CD, software bills of materials and container hardening across projects. You work with platform engineers, application teams and our security consultants, and you help clients answer supplier security questionnaires with facts.
What you will do
- Integrate SAST, DAST, dependency and container scanning into GitLab CI and GitHub Actions
- Generate and manage SBOMs in CycloneDX or SPDX and track vulnerabilities across releases
- Implement artefact signing and provenance with Sigstore and SLSA practices
- Define secure baselines for container images and Kubernetes workloads
- Coach development teams on threat modelling and secure coding
What you bring
- 3+ years in DevOps, platform or application security engineering
- Hands-on experience with CI/CD tooling and security scanners
- Good knowledge of containers, Kubernetes security and secret management
- Scripting in Python, Go or Bash
- Right to work in an EU member state and a home office within the EU
Good to have
- Familiarity with the Cyber Resilience Act and BSI TR-03183
- OSCP or a comparable offensive security background
Languages
English (C1), German (B1) an advantage