DevSecOps Engineer

Join CRFS, a leader in spectrum intelligence, as a DevSecOps Engineer. In this hands-on, mid-level role, you will help build security into the way we develop, build, and release our products. You will work with automated pipelines, implement security testing, manage vulnerabilities, and ensure compliance with customer and regulatory security requirements. This position offers flexible work models, paid time off, health care benefits, and opportunities for learning and development.

• Contribuer à la construction, à la maintenance et à l'amélioration des pipelines CI/CD automatisés pour le développement, la construction et la publication de logiciels.
• Mettre en œuvre et exploiter des tests de sécurité automatisés au sein des pipelines, y compris l'analyse statique, l'analyse des dépendances, la détection des secrets, les tests dynamiques, l'analyse des vulnérabilités.
• Aider à répondre aux exigences de sécurité des clients et des réglementations en durcissant les images de produits basées sur Linux et en produisant les résultats d'analyse répétables.

• Security Fundamentals: Hands-on exposure to security tooling in a development pipeline (e.g. SAST, dependency or vulnerability scanning), the ability to interpret a CVE and judge its real impact, and a sound grasp of least privilege, secrets management and patching
• Relevant Experience: Three or more years in a DevOps, DevSecOps, build/release or platform engineering role, or equivalent CI/CD-focused software engineering experience
• Problem Solving: A methodical approach to diagnosing build, infrastructure and security problems across unfamiliar codebases and systems
• Linux: Strong hands-on experience administering and securing Linux systems (Ubuntu/Debian), including shell scripting and networking fundamentals
• Automation: Proficiency in Python and Bash for automation and tooling, with a commitment to clean, maintainable code under version control (Git)
• CI/CD: Practical experience building and maintaining pipelines in GitLab CI, TeamCity, Jenkins, GitHub Actions or similar
• Collaboration: Clear written and verbal communication, able to explain security findings constructively and to own assigned work through to completion
• Containers: Working knowledge of Docker, including writing Dockerfiles, managing images and registries, and running builds in containers
• Regulated Environments: Experience working to security standards such as NIST SP 800-53 / RMF, DISA STIGs, CIS Benchmarks, FIPS 140, ISO 27001 or Cyber Essentials Plus, ideally in defense, aerospace or another regulated sector
• Infrastructure: Experience with Terraform or Ansible, virtualization platforms (e.g. Proxmox, VMware), self-hosted CI runners and AWS
• Security Tooling: Experience with tools such as OWASP ZAP, OWASP Dependency-Check, Trivy, Semgrep, SonarQube, Nessus or OpenSCAP, and with SBOM formats (CycloneDX, SPDX)
• Windows Build Environments: Experience with Windows build agents and PowerShell automation, including .NET/NuGet builds, code signing and installers
• Academic Background: A science or engineering degree in Computer Science, Electronics, or a similar field, or equivalent practical experience
• Build Systems: Familiarity with building C/C++ (CMake), Rust (Cargo), .NET and JavaScript/TypeScript projects on Linux and Windows; enough to debug a failing build and interpret scanner findings
• Embedded Linux: Exposure to embedded Linux delivery, such as Debian or Alpine packaging, root filesystem and image builds, cross-compilation and kernel modules
• Domain Interest: An interest in RF, signal processing or spectrum monitoring