DevSecOps Engineer

6-month contract to harden CI/CD pipelines and container supply chains for a security-conscious fintech client - real remediation work, not a compliance-checkbox engagement.

About Ironvale Security

Ironvale Security is a boutique security consultancy that embeds engineers directly into client engineering teams rather than delivering PDF audits and walking away. This engagement is with a mid-size fintech client hardening their deployment pipeline ahead of a SOC 2 Type II audit.

About The Role

You'll work embedded with the client's platform team to harden their CI/CD pipeline end-to-end: supply chain integrity, secrets management, and container image provenance. This is hands-on remediation work with a defined scope and a clear finish line, not open-ended advisory.

Responsibilities

• Implement SLSA-aligned build provenance for the client's container image pipeline
• Replace long-lived CI secrets with short-lived, workload-identity-based credentials
• Introduce SAST/dependency-scanning gates into the existing CI pipeline without blocking velocity
• Harden the container base images and enforce non-root, read-only-filesystem defaults
• Document the remediated pipeline for the client's SOC 2 Type II audit evidence

Requirements

• 4+ years in DevSecOps, security engineering, or platform engineering with a security focus
• Hands-on experience hardening CI/CD pipelines, not just writing policy
• Working knowledge of container image signing and supply chain security practices
• Available to start within 2-3 weeks of offer

Desirables

• Prior experience preparing a pipeline for a SOC 2 or ISO 27001 audit
• Familiarity with SLSA provenance and Sigstore/cosign image signing
• Comfortable working as an embedded contractor inside someone else's existing pipeline

Benefits

• Fully remote, flexible hours within US business overlap
• Weekly sync with Ironvale's principal consultant for support, not just client-side isolation
• Strong potential for contract extension or conversion to a longer engagement

Extras

• This is a 1099/contract engagement - not eligible for employee benefits