Project Overview & Business Challenge

• Company Introduction: Our development team uses Azure DevOps for our CI/CD pipelines, and our production environment is hosted on Azure. We are committed to a continuous deployment model.
• The Challenge: We have experienced several security incidents related to misconfigured pipelines and a lack of proper access controls in Azure. Our current CI/CD process is not fully secured, creating vulnerabilities in our deployment pipeline. We need to integrate security seamlessly into our DevOps workflow.
• Objective: The goal is to secure our Azure environment and automate security checks within our Azure DevOps pipelines, ensuring that security is a core part of our development and deployment process (DevSecOps).

Detailed Job Description & Responsibilities

• Core Tasks:
  • Conduct a security audit of our Azure DevOps pipelines and service connections.
  • Review and harden our Azure infrastructure and resource group permissions.
  • Implement security best practices for CI/CD pipelines (e.g., using secure variables, service principal with least privilege).
  • Integrate security scanning tools (e.g., for static code analysis, vulnerability scanning) directly into our pipelines.
  • Develop automated scripts to enforce security policies and configurations across our Azure resources.
  • Provide detailed documentation on the new DevSecOps workflow and train our internal team on best practices.

Required Skills & Qualifications

• Technical Expertise:
  • Extensive experience with Azure DevOps, including Pipelines, Repos, and Artifacts.
  • Proven expertise in Azure cloud infrastructure and security services (e.g., Azure Security Center, Key Vault).
  • Strong knowledge of scripting languages like PowerShell or Python.
  • Experience with Infrastructure as Code (IaC) tools like Terraform or ARM templates.
  • Microsoft Certified: Azure DevOps Engineer Expert or Azure Security Engineer Associate is highly desirable.

Soft Skills:

• Ability to work closely with development and operations teams.
• Excellent communication skills for technical explanations and training.
• Proactive and methodical approach to problem-solving.

Deliverables

• Tangible Outputs:
  • A comprehensive report on Azure DevOps and infrastructure security vulnerabilities.
  • Secured and updated CI/CD pipelines with integrated security checks.
  • Documentation of the new DevSecOps workflow and security policies.
  • A final report summarizing the project outcomes and recommendations.

Timeline 

• Timeline: Project is expected to be completed within 40-60 days.

How to Apply

• Instructions:
• Submit a detailed proposal outlining your approach to securing our Azure environment and DevOps pipelines.
• Share case studies of similar projects and a brief summary of your skills.
• Provide your desired compensation for the project.

Skills

• Technical: Azure DevOps, CI/CD, Azure Security, PowerShell, Python, Terraform, IaC, DevSecOps.
• Soft: Communication, Collaboration, Problem-solving, Training.