Security & DevSecOps Engineer (w/m/d) - für klinische Applikationen und Cloud-Lösungen

Job summary

The Security & DevSecOps Engineer role is essential for integrating Security-by-Design principles into software development and operations, ensuring compliance and security for clinical applications. Key responsibilities include developing secure architecture, conducting threat modeling, and automating security processes using technologies such as Java, Spring Boot, Docker, Jenkins, and Azure DevOps.

Benefits

Qualifications

• Completed degree in Computer Science, Medical Informatics, Software Engineering, Electrical Engineering, or a comparable qualification
• Solid experience in security engineering, application security, or DevSecOps
• Experience with security architectures, threat modeling, and structured risk analyses
• Good understanding of modern software development with Java, Spring Boot, Angular, REST APIs, and microservices
• Experience with CI/CD environments, particularly Jenkins and Azure DevOps
• Experience with Docker, Git, and automated security checks in build and release processes
• Knowledge of secure software development lifecycle, vulnerability management, and security testing
• Experience with Azure or AWS and Infrastructure as Code, such as Terraform
• Very good German and English language skills, both written and spoken

Responsibilities

• Develop secure architecture concepts for local server, container, and integration landscapes
• Conduct structured threat analyses, e.g., according to STRIDE, for new features and technical concepts
• Assess technical risks and derive concrete countermeasures
• Evaluate vulnerabilities based on their technical and business risks and derive targeted measures to reduce the attack surface
• Translate regulatory and organizational requirements into technical security controls
• Integrate automated security checks in Jenkins and Azure DevOps
• Incorporate SAST, DAST, SCA, secret scanning, container scanning, and dependency checks
• Design reusable pipeline templates, security gates, and evidence artifacts
• Secure Docker-based build, release, and deployment processes
• Support vulnerability management, security monitoring, and incident response processes
• Further develop security concepts for the software supply chain including SBOMs, artifact signing, provenance evidence, and dependency governance
• Act as a sparring partner for development, DevOps, testing, and architecture teams
• Assist teams with secure implementations and practical vulnerability remediation
• Foster a culture where security is integrated early, clearly, and without unnecessary friction

Skills

Certifications

Degrees

Languages

Relocation