- Location
- Kraków, PL
- Department
- Engineering
- Seniority
- Senior
- Experience
- 25+ years
- Closing date
- Today
- Source
- iCIMS
Description
Overview
We are looking for a Senior DevSevOps Engineer.
The role maps the operational attack surface while the other seniors assess the applications. It provides a clear view of the cloud, edge, network, and VM estate, with identified gaps ranked for remediation.
About Nortal
We’re Nortal. We think big and create cutting-edge digital solutions with a global reach. And with 25 years of experience, 2,700+ professional experts, and half a billion people worldwide impacted by our work, we believe we’ve got the numbers to back up that statement.
Our global teams have played a significant role in many Fortune 500 companies’ projects and systems and have been the driving force of digital transformation for governments, healthcare institutions, and leading enterprises worldwide. We combine best-in-class strategic consulting with software engineering, data, and design practices to bring our visions to life.
Responsibilities
- Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use
- Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner
- Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed
- Sets branch and repository hygiene rules
- Produces weekly progress reporting for the CISO
- In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team
Qualifications
- Around 6 years in DevOps or platform engineering, with solid DevSecOps experience
- Has built CI/CD security gates on GitHub Actions or Jenkins
- Vulnerability management at scale, including risk-based prioritisation
- Can turn findings data into reporting a non-technical leader trusts
Helpful:
- An aggregation tool such as DefectDojo
- Container and Kubernetes security
- SBOM generation and supply chain security (SLSA, Sigstore)
- Azure DevOps or AWS CodePipeline
- Building dashboards in Power BI or Datadog