TEMP Principal DevOps Engineer

ETS-Lindgren GmbH; Marlborough (MA); On-site; USD 206,640,000 - 282,408,000; Full time

Job summary

Doble Engineering seeks a contractor to migrate and fortify desktop/firmware CI pipelines into a unified Azure DevOps environment. You will embed threat modeling, Snyk scanning, and SBOM generation as standard in pipelines to meet CRA and IEC 62443-4-1 secure-SDLC requirements.

You will design multi-stage YAML pipelines, migrate from GitLab/SVN/Bitbucket to Azure DevOps Git, and containerize workflows with Docker and AKS. Expect collaboration with embedded/OT teams and a six-month engagement.

Qualifications

• 5+ years in DevOps / CI-CD engineering with hands-on Azure DevOps Pipelines and Git-based source-control migration.
• Experience building desktop/firmware or embedded build pipelines (not web-only).
• Knowledge of Snyk (SAST/SCA), SBOM generation, STRIDE threat modeling.

Responsibilities

• Design and implement Azure DevOps multi-stage YAML pipelines and migrate source-control from GitLab/SVN/Bitbucket to Azure DevOps Git.
• Containerize and manage build/scan workflows using Docker, AKS, and Azure Container Registry.
• Embed threat modeling, Snyk scanning, SBOM generation into pipelines for CRA/IEC 62443-4-1 compliant evidence.
• Harden pipelines by moving secrets to Azure Key Vault and enforcing least-privilege access.
• Ensure audit-trail artifacts for CRA Annex VII and maintain traceability with Jira/ADO.

Skills

CI/CD engineering

Threat modeling

Security

Azure DevOps

Snyk

Security mindset

Tools

Azure DevOps Pipelines

Git-based migrations

Docker

Kubernetes

Snyk

SBOM tooling (CycloneDX/SBOM)

Job description

Essential Functions — DevOps & CI Migration

A temporary (6 Months) contractor to support the Bologna and Taino (Altanova) engineering teams in migrating their desktop-application and firmware CI pipelines from GitLab/SVN/Jenkins/ADO into Doble’s common Azure DevOps environment, while strengthening product-security practices required by the EU Cyber Resilience Act (CRA) and the IEC 62443-4-1 secure-development lifecycle. The contractor will embed threat modeling, Snyk scanning, and SBOM generation directly into the migrated pipelines so that CRA/CE technical evidence is produced as a by-product of day-to-day engineering.

• Design and build Azure DevOps multi-stage YAML pipelines, repos, service connections, agent pools, and variable/secret groups for the migrated teams.
• Execute source-control migration from GitLab, SVN, and Bitbucket into Azure DevOps Git, including history, and advise on project/repo structuring (project-per-product vs. multi-repo).
• Support desktop / thick-client and firmware builds — C/C++, .NET, FPGA toolchains, code-signing, and Yocto / embedded-Linux build servers in Azure.
• Containerize and manage build/scan workflows using Docker, AKS, and Azure Container Registry.
• Provide CI support for monolith-to-microservices refactoring (strangler pattern), standing up per-microservice pipelines.
• Create reusable pipeline templates so the common environment is consistent across teams; manage infrastructure with Terraform.

Essential Functions — Security, Threat Modeling & CRA

• Perform threat modeling using STRIDE (plus attack trees / MITRE ATT&CK for ICS where appropriate), producing data-flow diagrams with trust boundaries during the requirements/design phase.
• Threat models must cover information flows, trust boundaries, data stores, external entities, comms protocols, externally accessible physical/debug ports, JTAG/debug headers and hardware attack vectors, CVSS-scored threats, and documented mitigations — aligned to IEC 62443-4-1 SR-2.
• Build a reusable threat-model template and repeatable process, and feed outputs into CRA risk assessments (asset ID → threat modeling → risk evaluation) and Stage-Gate / Jira / ADO traceability.
• Configure and operate Snyk — Snyk Code (SAST), Open Source (SCA), Container, and SBOM — as pipeline stages in ADO/Jenkins, set severity gates, and onboard new repos to raise coverage.
• Add automated SBOM generation (CycloneDX/SPDX, machine-readable, per release) to each migrated pipeline.
• Harden pipelines: move secrets to Azure Key Vault (no hard-coded credentials), secure service connections, enforce least-privilege on ADO/AKS.
• Validate that mitigations work (SVV-2 threat-mitigation testing) and produce audit-trail artifacts (scan results, threat models, SBOMs, test records) for the CRA Annex VII technical file.

Requirements Summary — Must vs. Preferred vs. Nice-to-Have

Priority

DevOps / CI

Security, CRA & Threat Modeling

Must-have

Snyk (SAST/SCA/Container/SBOM); STRIDE threat modeling with DFDs & trust boundaries; SBOM in-pipeline; CRA + IEC 62443-4-1 secure-SDLC awareness

Strongly preferred

Embedded/OT & hardware threat modeling (debug/JTAG ports, FPGA); CVSS scoring; CVD / vuln-handling SLAs; secrets hardening (Key Vault)

Nice-to-have

Bitbucket / Jenkins / SVN; code-signing; artifact management

Minimum Qualifications

• 5+ years in DevOps / CI-CD engineering with hands-on Azure DevOps Pipelines and Git-based source-control migration.
• Demonstrated experience building desktop/firmware or embedded build pipelines (not web-only).
• Working knowledge of Snyk (or equivalent SAST/SCA), SBOM generation, and STRIDE threat modeling.
• Familiarity with the EU CRA and IEC 62443-4-1 secure-development lifecycle concepts.
• English working proficiency; Italian a strong plus given the mixed-language migration meetings.

PHYSICAL REQUIREMENTS:

While performing the duties of this job the employee is often required to stand, sit, use computers, read, write, type, use copy machines, file paperwork, use telephones, and utilize written and oral communication to interact with clients, co-workers , and customers. Reasonable accommodations may be made to enable individuals to perform the essential functions of this job. Must be capable of lifting 30 pounds. Must use assistance when lifting 50 or more pounds.

Actual base salary offered to the hired applicant will be determined based on their work location, level, qualifications, job related skills, as well as relevant education or training experience.
Hourly Pay: $85.00

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities

We are an Equal Employment Opportunity employer that values the strength diversity brings to the workplace. All qualified applicants, regardless of race, color, religion, gender, sexual orientation, marital status, gender identity or expression, national origin, genetics, age, disability status, protected veteran status, or any other characteristic protected by applicable law, are strongly encouraged to apply.

The Americans with Disabilities Act of 1990 (ADA) prohibits discrimination by employers, in compensation and employment opportunities, against qualified individuals with disabilities who, with or without reasonable accommodation, can perform the “essential functions” of a job. A function may be essential for any of several reasons, including: the job exists to perform that function, the employee holding the job was hired for his/her expertise in performing the function, or only a limited number of employees are available to perform that function.

Applicants must be authorized to work for any employer in the United Sates. Doble Engineering is unable to sponsor or take over sponsorship of an employment visa at this time.

Equal Opportunity Employer/Protected Veterans/Individuals with Disabilities
This employer is required to notify all applicants of their rights pursuant to federal employment laws.For further information, please review the Know Your Rights notice from the Department of Labor.