Senior DevSecOps Engineer (Offensive Security Focus)

Neotrust; Lyon; Hybride; EUR 65 000 - 85 000; Plein temps

Résumé du poste

A leading cybersecurity firm is looking for a Senior DevSecOps Engineer to elevate application security with a focus on Offensive Security. This role involves performing penetration tests, integrating security in CI/CD processes, and collaborating with teams to automate security controls. The ideal candidate has a strong background in application penetration testing, secure coding practices, and familiarity with Azure DevOps. Competitive compensation and the flexibility to work remotely or hybrid are offered for this impactful position.

Qualifications

• Strong track record in application penetration testing.
• Familiarity with DAST tools and manual exploitation techniques.
• Experience with cloud security and container security.

Responsabilités

• Perform targeted penetration tests on applications.
• Integrate security into CI/CD pipelines.
• Run security reviews for new applications.

Connaissances

Application penetration testing

Secure coding

Azure DevOps pipelines

DevSecOps architecture

Communication skills

Outils

Burp Suite

ZAP

Nmap

Metasploit

Snyk

Description du poste

Job Description — Senior DevSecOps Engineer (Offensive Security Focus)

Location : Hybrid (Paris) or Remote (France / Europe)

Department : Cybersecurity / DevSecOps

Seniority : Senior / Expert

Duration : 1 year (renewable)

Contract : Full-time ( Freelance )

About the role

We’re looking for a Senior DevSecOps Engineer with a strong Offensive Security mindset to elevate our application security across the full SDLC. You’ll combine hands‑on penetration testing skills with modern DevSecOps practices to find real‑world risks, automate security controls, and help engineering teams ship secure software faster.

You’ll work closely with developers, cloud / platform teams, and architects to integrate security into CI / CD, strengthen cloud‑native workloads, and build a strong secure engineering culture.

What you’ll do

Offensive Security / Application Security

• Perform targeted penetration tests on web, API, mobile, and cloud‑native applications.
• Conduct threat modeling and adversarial analysis on critical services.
• Identify, exploit, and validate vulnerabilities to assess real impact and exploitability.
• Perform secure code reviews (manual and tooling / AI‑assisted).

DevSecOps Integration

• Improve SAST, SCA, DAST, IaC, and container scanning in Azure DevOps pipelines (Snyk experience is a major plus).
• Automate security gates and enforce quality thresholds in CI / CD.
• Build custom security checks, scripts, and DevSecOps automations.
• Improve developer workflows by providing secure coding guidance and actionable fixes.

Secure SDLC & Continuous Hardening

• Run security reviews for new applications and major releases.
• Support Security Champions and coach development teams.
• Participate in incident response and post‑mortems for security issues.
• Collaborate with Cloud Security on posture management and remediation.

Security Automation & AI

• Develop or tune AI agents to support vulnerability analysis and remediation.
• Automate correlation of findings across tools (SAST / SCA / Cloud).
• Contribute to internal security dashboards and metrics (Power BI, API integrations).

What we’re looking for

Required experience

• Strong track record in application penetration testing (OWASP Top 10, API attacks, auth bypass, RCE, business logic flaws).
• Strong understanding of secure coding (C#, Java, JS / TS, Python, etc.).
• Familiarity with DAST tools plus manual exploitation techniques.
• Deep knowledge of authN / authZ (OAuth2, OIDC, JWT).
• Strong grasp of DevSecOps architecture and SDLC best practices.

Hands‑on experience with :

• Azure DevOps pipelines
• Azure Cloud (App Services, Functions, IAM, Storage, Key Vault)
• Container security (Docker, Kubernetes basics)
• Snyk (SAST / SCA / IaC / Cloud) (highly valued)

Tooling & frameworks

• Burp Suite, ZAP, Nmap, Postman, Metasploit, custom scripts.
• Threat modeling methods (MITRE ATT&CK, STRIDE).
• Source code review with or without tooling.

Soft skills

• Ability to challenge designs and architectures from an attacker’s POV.
• Clear communication with technical and non‑technical stakeholders.
• Strong ownership, mentoring mindset, and leadership on security topics.
• Analytical thinking, problem‑solving, pragmatism.

Nice to have

• Certifications (preferred, not required) : OSWE / OSCP / OSEP / GWAPT , AZ-500 / AZ-400 or similar.
• Experience in large enterprise environments.
• Experience with AI‑assisted AppSec tooling and workflows.

Why join us

• High‑impact role with real ownership over AppSec and DevSecOps practices.
• Modern cloud‑native stack (Azure) and a strong focus on automation.
• Opportunity to blend offensive security with engineering enablement and AI‑powered security.