DevSecOps Engineer - Confirmed - 60k€/75k€

Based in: Paris (possibility of partial remote)

Contract: Full-time

Manager: Farah 

Department: Tech

Package: 55k-65k (it depends on the profile, Confirmed or Senior)

Context:

At Worklife, we're pioneers of a new era of work. Our mission? To transform the employee experience by providing benefits that make a real difference every day. Since September 2023, our expertise has joined forces with Crédit Agricole to maximize our impact and go further in supporting you: from employee savings to retirement and even group health insurance.

Today, we are on the lookout for a DevSecOps Engineer to help us grow and improve on these topics.

Joining the team at Worklife, currently composed of:

1 Principal engineering

4 Backend (including staff engineer)

2 Frontend

2 Devops

2 QA

3 Mobile (1 Android, 1 iOS, 1 Fullstack)

Our stack :

Nuxt 2 (Vue.js) & React

GraphQL Gateway in Node.js (Apollo)

REST Microservices in Python (Fast API)

Gitlab (Version control + CI/CD)

Figma (Interface design)

Linear (Project management)

Docker for dev env

Kubernetes for deployments (Helm)

Terraform (on AWS)

Datadog/Sentry

Documentation on Notion

Data stack: Segment, Airflow, Airbyte, DBT, Postgres data warehouse

🚀 We're in a phase of development and Test & Learn. This means you'll have the opportunity to co-create our processes and contribute to the shaping of Worklife. To thrive in this, an intrapreneurial mindset is crucial—you should be ready to roll up your sleeves and navigate through temporary turbulence with a smile 🙂.

Daily Job:

Within our Tech team, you will strengthen our security policies while being an enabler for our tech team to maintain our delivery momentum. Therefore, you will:

- Implement security policies to ensure compliance with ISO 27001 standards.

- Maintain documentation for security compliance and governance, including our PSSI.

- Secure infrastructure and tools (hardware and software), and develop an access management policy for our information system.

- Craft responses and complete security questionnaires for the Tender Process, highlighting our security practices and certifications.

- Manage internal and external security audits, showcase compliance with security controls, and proactively address audit findings to initiate and oversee improvement initiatives.

- Coordinate and facilitate penetration testing activities, respond to findings, and implement corrective actions.

- Drive a security-conscious culture by documenting best practices and delivering ongoing security training to sensitize teams about emerging threats and industry best practices.

- Develop and integrate security checks by incorporating automated vulnerability assessment tests in CI/CD pipelines.

Expected Results during Onboarding:

D +30 :

- Meet your stakeholders and get to know everyone, who they are, and what they do.

- Set up your environment.

- Explore our code base and familiarize yourself with our product.

- Read and challenge our documentation. Ask all the questions

- Familiarization with company security policies, and existing infrastructure and architecture.

D +60 :

- Begin documentation of current security compliance and governance practices.

- Initial assessment of the current access management policy and infrastructure security.

- Participate in at least one tender process, providing security-focused responses.

- Complete a draft of revised security policies and access management procedures.

D +90 :

- Initiate the first round of internal security training sessions.

- Establish a routine for ongoing penetration testing and vulnerability assessments.

- Start Integrating automated security checks into the CI/CD pipeline.

A little more about you:

We believe that diversity of profiles contributes to the success of Worklife and we therefore make every effort to ensure that inclusion, equity and accessibility are at the heart of our recruitment processes.

Pre-requisites:

- Minimum of 2 years experience in software security within an engineering team, with a strong focus on implementing ISO 27001 standards and security policy development.

- Demonstrated knowledge of web application security risks, including OWASP guidelines, and experience with technologies like WAF, IDS/IPS, and RASP.

- Proficiency in a major cloud platform, preferably AWS, coupled with experience in Kubernetes for deploying and managing applications.

- Hands-on involvement in Identity and Access Management projects, including SSO, provisioning, and PAM.

- Practical experience with security event detection tools like SIEM systems, for monitoring and responding to security incidents.

- Comfortable with modern web applications, Event-Driven Development, and Micro-services architecture, and adept at using programming languages like Python and infrastructure-as-code tools such as Terraform.

- Excellent communication skills in both French and English

- Engagement with cybersecurity communities is a plus.

- Knowledge of financial compliance regulations like PSI-DSS and AML is a plus.

Our evaluation criteria (scorecard) for this role:

- You are experienced with software security and implementing ISO 27001 standards.

- You have an active engagement in self-learning and participation in security communities to stay at the forefront of industry trends and practices.

- You have demonstrated autonomy in managing tasks, with the ability to seek help and collaborate effectively when necessary.

- You have an open-minded approach and strong communication skills, vital for articulating viewpoints and managing client-facing tasks.

- You have a strong problem-solving ability, capable of creatively addressing complex challenges.

- You are resilient, able to handle high-pressure situations, and adapt rapidly to changing environments.

Our evaluation criteria (scorecard) for the culture fit:

Be impactful: Communication, Engagement & Collaboration

Never give up: Challenging, Resilience & Boldness

Level up: Test & Learn, Open-mindedness & Step-back & question yourself

If you see yourself in this description, don't hesitate to apply! Even if you don't tick all the boxes, we value quick learners and motivated individuals. Take a chance, and let's discuss what's possible for a smooth ramp-up 😉.

What we do:

At Worklife, we redefine employee benefits with our innovative Fin/HR tech approach! One application paired with a single payment card—everything you need for streamlined use.

Employee benefits often lack recognition, visibility, and no longer cater to the real needs of both employees and the company. We assist our clients in implementing a compensation strategy that has a real impact and meaning for employees and the company. In just 2 years, we've reached over 100,000 employees from companies like Saint-Gobain, Amazon, Danone, Adecco, etc., making us the #1 player in France for sustainable mobility.

So, if you want to be a part of this revolution and join a rapidly growing company, now is the time!

Your Employee Benefits:

• We offer a remuneration at market price, re-evaluated every year (according to the market, our performance and your results) as well as + 3 000€ of employee benefits 👇
• €8.50/day worked of meal vouchers (50% paid by the employer) and many other benefits (Frichti, Hello Fresh, ...)
• 800€/year of mobility allocation (public transport pass, scooter, bike purchase, single metro ticket, ...)
• €100/month (€150/month for parents) of care services (childcare, homework help, housework help, sports coach, etc.)
• 150€/year of remote allocation for your expenses and a monthlyflexible work organisation
• A mutual insurance: Alan (50% paid by the employer)
• “RTT” (number of days defined according to the law, 8 for 2023)
• An excellent work environment: an international environment, team events, offsite, beautiful offices in the 11th district
• The pleasure and pride of using our own product on a daily basis (and of testing all the advantages offered!)

In addition, you will be working in an international environment which will lead you to meet a diversity of profiles, which is one of the riches of Worklife.

Recruitment Process:

• You'll meet Florian or Marlène (Talent Acquisition) for a first call (Getting to know you, Company culture, organization, salary, logistics …)
• Google meet with your future manager, Farah (CTO) to tell you more about the daily job and understand your expectations
• Home tech test for you to showcase a bit of your magic (we'll then do a case review with people from the team: Farah and Oscar)
• You can, if you want to, meet other people from the team ☕️

We do our best to have a process of about 20 days, and we send an offer within 48 hours 🤞