Senior DevSecOps Engineer

Jobtailor; Deutschland; Vor Ort; EUR 75.000 - 105.000; Vollzeit

Zusammenfassung

Jobtailor is seeking a DevSecOps / Cloud Security Engineer in Germany to build secure CI/CD pipelines, enforce policy-as-code, and harden Kubernetes environments. You’ll protect cloud identities, manage Secrets, and secure ML/AI platforms like Databricks Unity Catalog.

You will collaborate with central security and compliance teams, drive threat modeling, and ensure audit readiness, governance, and KPI reporting across the data & AI platform.

Qualifikationen

• Experience as a DevSecOps or Cloud Security Engineer in Azure and Kubernetes.
• Hands-on with Azure DevOps and GitHub Actions; automating guardrails.
• Knowledge of Azure security services (Entra ID, Key Vault, Defender, Sentinel).
• Familiar with vulnerability management: SBOMs, CVEs, scans, triage, remediation.
• Understanding of Data & AI security: Databricks Unity Catalog, MLflow, model registry.
• Ability to work with security/compliance teams and contribute to audits.
• Shift-left mindset; codify controls across teams.

Aufgaben

• Build secure CI/CD pipelines with emphasis on secrets hygiene and signed artifacts.
• Enforce policy-as-code and continuous IaC scanning for infrastructure.
• Harden Kubernetes with RBAC, network policies, and image signing.
• Protect cloud identities, Key Vault, encryption, and access controls.
• Secure ML/AI platforms, Databricks Unity Catalog, and model registries.
• Wire telemetry to security platforms and support incident response.
• Manage SBOMs, vulnerability scans, and remediation tracking.
• Contribute to risk assessments, threat modeling, and audit readiness.
• Maintain governance of security baselines, access reviews, and KPIs.

Kenntnisse

DevSecOps

Cloud Security

Azure

Kubernetes Security

SBOM Vulnerability

Databricks Unity Catalog

MLflow Security

Threat Modeling

Audits & Compliance

Cross-team Collaboration

Tools

Azure DevOps

GitHub Actions

Terraform

Jobbeschreibung

Responsibilities

• Build and maintain secure CI/CD pipelines (Azure DevOps or GitHub Actions): secrets hygiene, signed artifacts/SBOMs, SAST/DAST/container scanning, least-privilege service connections, and supply-chain hardening.
• Automate security in infrastructure with Terraform: enforce guardrails using policy-as-code (Azure Policy, OPA/Conftest) and continuous IaC scanning (Checkov/tfsec).
• Harden Kubernetes: implement RBAC, NetworkPolicies, Pod Security Standards, secret management, image signing/scanning, and admission policies (Gatekeeper/Kyverno).
• Protect cloud identities & data: manage Entra ID roles/Managed Identities, Key Vault, Private Link/NSGs, encryption at rest/in transit, and just-in-time/least-privilege access.
• Secure ML/MLOps: lock down Databricks (Unity Catalog permissions, secret scopes), MLflow/model registry, feature stores; add model artifact signing, provenance, and runtime isolation for training/serving.
• Monitoring, logging & response: wire platform and security telemetry to Microsoft Sentinel/Defender, define alerts/runbooks, and support incident response and tabletop exercises.
• CVE & vulnerability management: maintain and publish SBOMs; continuously scan for vulnerabilities; triage CVEs (e.g., CVSS scoring + exploitability context), coordinate mitigations/patches, track exposure windows and SLAs, verify remediation, and report metrics to SecOps/GRC.
• Concepts & architecture: draft and maintain reference architectures, trust-boundary diagrams, data-classification schemes, environment isolation patterns, secure secret/key management patterns, and network segmentation for AI services.
• Compliance & assurance: contribute to risk assessments and threat modeling (incl. AI-specific risks: prompt injection, data exfiltration, model theft), support DPIAs, vendor/third-party risk reviews, penetration tests, control testing, evidence collection, and audit readiness for ISO 27001, GDPR, and EU AI Act/NIS2 where applicable.
• Governance: maintain security baselines and exceptions, own platform security KPIs, ensure retention policies, access reviews, and end-to-end audit trails (code → data → model → deployment).

Requirements

• Experience as a DevSecOps / Cloud Security Engineer (or DevOps with strong security focus) in Azure and Kubernetes environments.
• Hands-on with Azure DevOps/GitHub Actions; comfortable automating guardrails and checks in pipelines.
• Working knowledge of Azure security (Entra ID, Key Vault, Azure Policy, Defender for Cloud, Sentinel) and Kubernetes security.
• Familiar with vulnerability management & CVEs (SBOM creation, dependency/container/IaC scanning, triage/prioritization, remediation workflows, SLA tracking).
• Understanding of Data & AI/ML security: Databricks (Unity Catalog, SCIM/AAD), MLflow/model registry, secrets, data governance, and privacy-by-design.
• Comfortable interfacing with central Security and compliance teams, contributing to audits and group standards, and translating requirements into practical controls.
• A shift-left mindset: you collaborate across teams, codify controls, and enjoy solving real-world security challenges in cloud-based Data & AI platform.