Senior DevSecOps Engineer (Offensive Security Focus)

Neotrust; Nice; Hybride; EUR 70 000 - 90 000; Plein temps

Résumé du poste

A cybersecurity firm is seeking a Senior DevSecOps Engineer with an emphasis on Offensive Security. This hybrid role involves conducting penetration tests, integrating security into CI/CD pipelines, and mentoring development teams. Required qualifications include strong skills in application security and familiarity with Azure Cloud and DevSecOps practices. Join us to elevate application security and make a significant impact within a modern, cloud-native environment.

Prestations

Opportunity for professional development

High-impact projects

Focus on automation and AI

Qualifications

• Strong track record in application penetration testing involving OWASP Top 10.
• Deep knowledge of authN/authZ mechanisms.
• Competent in secure code review processes.

Responsabilités

• Perform targeted penetration tests on various applications.
• Improve security automation in CI/CD pipelines.
• Support Security Champions and coach development teams.

Connaissances

Application penetration testing

Secure coding (C#, Java, JS/TS, Python)

Azure Cloud

DevSecOps architecture

Analytical thinking

Outils

Azure DevOps pipelines

Burp Suite

Snyk

Threat modeling methods

Description du poste

Job Description — Senior DevSecOps Engineer (Offensive Security Focus)

Location : Hybrid (Paris) or Remote (France / Europe)

Department : Cybersecurity / DevSecOps

Seniority : Senior / Expert

Duration : 1 year (renewable)

Contract : Full-time ( Freelance )

About the role

We’re looking for a Senior DevSecOps Engineer with a strong Offensive Security mindset to elevate our application security across the full SDLC. You’ll combine hands‑on penetration testing skills with modern DevSecOps practices to find real‑world risks, automate security controls, and help engineering teams ship secure software faster.

You’ll work closely with developers, cloud / platform teams, and architects to integrate security into CI / CD, strengthen cloud‑native workloads, and build a strong secure engineering culture.

What you’ll do

Offensive Security / Application Security

• Perform targeted penetration tests on web, API, mobile, and cloud‑native applications.
• Conduct threat modeling and adversarial analysis on critical services.
• Identify, exploit, and validate vulnerabilities to assess real impact and exploitability.
• Perform secure code reviews (manual and tooling / AI‑assisted).

DevSecOps Integration

• Improve SAST, SCA, DAST, IaC, and container scanning in Azure DevOps pipelines (Snyk experience is a major plus).
• Automate security gates and enforce quality thresholds in CI / CD.
• Build custom security checks, scripts, and DevSecOps automations.
• Improve developer workflows by providing secure coding guidance and actionable fixes.

Secure SDLC & Continuous Hardening

• Run security reviews for new applications and major releases.
• Support Security Champions and coach development teams.
• Participate in incident response and post‑mortems for security issues.
• Collaborate with Cloud Security on posture management and remediation.

Security Automation & AI

• Develop or tune AI agents to support vulnerability analysis and remediation.
• Automate correlation of findings across tools (SAST / SCA / Cloud).
• Contribute to internal security dashboards and metrics (Power BI, API integrations).

What we’re looking for

Required experience

• Strong track record in application penetration testing (OWASP Top 10, API attacks, auth bypass, RCE, business logic flaws).
• Strong understanding of secure coding (C#, Java, JS / TS, Python, etc.).
• Familiarity with DAST tools plus manual exploitation techniques.
• Deep knowledge of authN / authZ (OAuth2, OIDC, JWT).
• Strong grasp of DevSecOps architecture and SDLC best practices.

Hands‑on experience with :

• Azure DevOps pipelines
• Azure Cloud (App Services, Functions, IAM, Storage, Key Vault)
• Container security (Docker, Kubernetes basics)
• Snyk (SAST / SCA / IaC / Cloud) (highly valued)

Tooling & frameworks

• Burp Suite, ZAP, Nmap, Postman, Metasploit, custom scripts.
• Threat modeling methods (MITRE ATT&CK, STRIDE).
• Source code review with or without tooling.

Soft skills

• Ability to challenge designs and architectures from an attacker’s POV.
• Clear communication with technical and non‑technical stakeholders.
• Strong ownership, mentoring mindset, and leadership on security topics.
• Analytical thinking, problem‑solving, pragmatism.

Nice to have

• Certifications (preferred, not required) : OSWE / OSCP / OSEP / GWAPT , AZ-500 / AZ-400 or similar.
• Experience in large enterprise environments.
• Experience with AI‑assisted AppSec tooling and workflows.

Why join us

• High‑impact role with real ownership over AppSec and DevSecOps practices.
• Modern cloud‑native stack (Azure) and a strong focus on automation.
• Opportunity to blend offensive security with engineering enablement and AI‑powered security.