Senior DevSecOps Engineer

Nortal; Kraków; On-site; PLN 240,000 - 340,000; Full time

Benefits offered by this job

DefectDojo usage

Kubernetes security focus

Job summary

Nortal is seeking a Senior DevSecOps Engineer to map the operational attack surface across cloud, edge, network, and VM estates. You will lead pipelines, implement security gates, and drive vulnerability management with clear, executive-friendly reporting.

The role includes coordinating cloud and infrastructure engineers and a vulnerability analyst within DevOps, guiding secure delivery globally. Based in Kraków, the role focuses on building robust security gates, triage processes, and

Qualifications

• 6+ years in DevOps or platform engineering with a DevSecOps focus.
• Experience building CI/CD security gates on GitHub Actions or Jenkins.
• Vulnerability management at scale with risk-based prioritisation.
• Ability to translate findings into reporting trusted by non-technical leaders.

Responsibilities

• Maps pipelines (GitHub Actions, Jenkins, ArgoCD, Helm, AWS CodePipeline) and scanners.
• Builds a triage process to aggregate outputs, remove duplicates, and rank risk.
• Adds SAST, SCA, secrets, container and IaC scanning to pipelines, gating fixes.
• Sets branch and repository hygiene rules.
• Produces weekly security progress reporting for the CISO.
• Leads cloud/infrastructure engineers and vulnerability analysts in DevOps during phase 2.

Skills

DevOps

DevSecOps

CI/CD security gates

GitHub Actions

Jenkins

Vulnerability management

Reporting to leadership

Tools

DefectDojo

Kubernetes security

Azure DevOps

AWS CodePipeline

SLSA/Sigstore

Power BI

Job description

Overview

We are looking for a Senior DevSevOps Engineer.

The role maps the operational attack surface while the other seniors assess the applications. It provides a clear view of the cloud, edge, network, and VM estate, with identified gaps ranked for remediation.

About Nortal

We’reNortal. We think big and createcutting-edgedigital solutions with a global reach. And with 25 years of experience, 2,700+ professional experts, and half a billion people worldwideimpactedby our work, we believewe’vegot the numbers to back up that statement.

Our global teams have played a significant role in many Fortune 500 companies’ projects and systems and have been the driving force of digital transformation for governments, healthcare institutions, and leading enterprises worldwide. We combine best-in-class strategic consulting with software engineering, data, and design practices to bring our visions to life.

Responsibilities

• Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use
• Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner
• Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed
• Sets branch and repository hygiene rules
• Produces weekly progress reporting for the CISO
• In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team

Qualifications

• Around 6 years in DevOps or platform engineering, with solid DevSecOps experience
• Has built CI/CD security gates on GitHub Actions or Jenkins
• Vulnerability management at scale, including risk-based prioritisation
• Can turn findings data into reporting a non-technical leader trusts

Helpful:

• An aggregation tool such as DefectDojo
• Container and Kubernetes security
• SBOM generation and supply chain security (SLSA, Sigstore)
• Azure DevOps or AWS CodePipeline
• Building dashboards in Power BI or Datadog

In your resume please allow our company to use your personal data