DevOps Engineer (security)

Onapsis · Bucharest, Bucharest, Romaniamid

In short

▸Ingeniero DevSecOps enfocado en seguridad dentro del ciclo de vida del software.
▸Automatización de pruebas de seguridad (SAST/DAST/SCA) y gestión de vulnerabilidades en pipelines CI/CD.
▸Destacado: Trabajas en una plataforma que protege aplicaciones críticas como SAP y Oracle de grandes empresas.

Proficiency in English required for collaboration with global teams.

In ~1 minute you get: who interviews you, the likely questions answered from your CV, and your CV tailored to this job. Free, no card.

🎧Land the interview? Bring the copilot. Our free extension listens to the live interview and flashes 3-4-word anchors from your resume and prep — glance, connect, talk. Get the extension →

What they ask for

✓2+ años de experiencia en ciberseguridad con enfoque en Shift-Left
✓Conocimiento práctico en pruebas SAST, DAST, SCA y gestión de dependencias abiertas
✓Experiencia en modelado de amenazas y revisión de código seguro
✓Experiencia en DevOps con AWS, Git/GitLab y CI/CD
✓Conocimiento de contenedorización con Docker y Kubernetes
✓Familiaridad con estándares de cumplimiento como ISO 27001, NIST 800-53, PCI DSS

Don't tick every box? That's normal — your free dossier shows your gaps and how to cover them in the interview.

GitLab CI/CDSASTDASTSCAAWSAzureGCPDockerKubernetesGrafana

Who should you write to at Onapsis?

Your free dossier identifies the people who'd interview you — their background, what they value, and how to reach out so you stand out before applying.

About the job The world’s most critical--and at-risk--business applications have been neglected for far too long. Onapsis eliminates this blind spot by providing cybersecurity solutions dedicated to business-critical applications. Onapsis helps nearly 30% of the Forbes Global 100 understand the threats and risks across their SAP and Oracle landscapes, whether running on-premises, in the cloud, or in a hybrid environment. We are looking for self-motivated and enthusiastic DevSecOps Engineer who want to impact cybersecurity by continuing to advance, maintain, and enhance our platform features in Threat Detection & Response, Vulnerability Management, and Compliance Automation. What you will be doing, your legacy: Working closely with leadership, product management, and our Engineering and Operations teams to design and implement security-focused capabilities across the SDLC using Shift-Left-On-Security principles. This role partners with InfoSec, Technical Operations, and Platform Engineering teams to ensure CI/CD frameworks, infrastructure, and automation tooling are secure by design, resilient, and capable of protecting our customers at scale. Key Responsibilities: • Security Automation & CI/CD: Embed, maintain, and optimize automated security testing (SAST, DAST, SCA) directly into GitLab CI/CD pipelines. • Vulnerability & Patch Management: Perform platform security assessments, verify reported exploits, and support vulnerability remediation activities. • Security Compliance: Participate in security audits, provide actionable feedback, and coordinate with engineering teams to meet compliance timelines and regulatory standards. • Penetration Testing Enablement: Provision and configure isolated test environments, deploy target application builds, and coordinate secure access requirements for penetration testing activities. • Security Operations & Incident Response: Collaborate with cross-functional teams to evaluate security releases, generate compliance reports, and support security monitoring/observability using Grafana, New Relic, or OpenTelemetry. • Security Advocacy: Conduct internal software security training and advocate for secure coding standards and DevSecOps best practices across engineering teams. • Threat Modeling & Risk Mitigation: Conduct threat modeling exercises for new features and infrastructure changes to identify vulnerabilities before code hits production. Requirements: Cybersecurity Expertise (2+ Years) • Hands-on experience implementing Shift-Left-On-Security frameworks within the SDLC. • Practical knowledge of application security testing methodologies, specifically SAST, DAST, SCA, and OSS management. • Experience conducting Threat Modeling exercises and performing secure code reviews. • Awareness of penetration testing (blackbox, whitebox) methods • Plus: Knowledge of compliance and auditing standards (ISO 27001/27002, NIST 800-53, PCI DSS, CIS Controls) or active SecOps experience. DevOps & Cloud Infrastructure (1+ Years) • Proven experience in DevOps practices utilizing Cloud Technologies (AWS preferred, Azure, GCP) • Good understanding of the Software Development Lifecycle ( SDLC ), its phases and how to embed Security in each of them • Experience in Version Control tools and CI/CD ( Git/GitLab) , including branching, and pipeline development. • Knowledge of containerization and orchestration using Docker and Kub

Don't apply unprepared

We research who's interviewing you, tailor your CV and rehearse you live — first one free.