Senior DevSecOps Engineer: CI/CD Security & Vulnerability Lead

Nortal; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Nortal in the United States is seeking a Senior DevSecOps Engineer to map the operational attack surface across cloud, edge, network, and VM estates, and to drive remediation by prioritizing gaps. You will collaborate with senior colleagues to secure pipelines and automate scanning.

The role encompasses leading cloud and infrastructure engineers, implementing SAST, software composition analysis, secrets management, and IaC scanning, and delivering weekly risk reporting to the CISO; advanced

Qualifications

• Around 6 years in DevOps or platform engineering, with solid DevSecOps experience.
• Has built CI/CD security gates on GitHub Actions or Jenkins
• Vulnerability management at scale, including risk-based prioritisation
• Can turn findings data into reporting a non-technical leader trusts

Responsibilities

• Maps the pipelines (GitHub Actions, Jenkins with Groovy, ArgoCD and Helm, AWS CodePipeline) and the scanners currently in use
• Builds one triage process that pulls scanner output together, removes duplicates, ranks by real risk (CVSS, EPSS, CISA KEV, reachability) and tracks each item to fixed, contained or risk-accepted with a named owner
• Adds SAST, software composition analysis, secrets, container and infrastructure-as-code scanning to the pipelines, gated so fixed issues stay fixed
• Sets branch and repository hygiene rules
• Produces weekly progress reporting for the CISO
• In phase 2, leads the cloud and infrastructure engineers and the vulnerability management analyst inside DevOps team

Skills

DevSecOps experience

Vulnerability management

Risk-based prioritisation

CI/CD security gates

Technical reporting

Leadership/mentoring

Tools

GitHub Actions

Jenkins

ArgoCD

Helm

AWS CodePipeline

DefectDojo

Power BI

Datadog

Azure DevOps

Job description

Nortal in the United States is seeking a Senior DevSecOps Engineer to map the operational attack surface across cloud, edge, network, and VM estates, and to drive remediation by prioritizing gaps. You will collaborate with senior colleagues to secure pipelines and automate scanning.

The role encompasses leading cloud and infrastructure engineers, implementing SAST, software composition analysis, secrets management, and IaC scanning, and delivering weekly risk reporting to the CISO; advanced