Description

We are looking for a DevSecOps Consultant specialised in AppSec to work on securing web applications in cloud environments.

You will join Cybersherpa, a growing cybersecurity consultancy driven by a committed team passionate about making a practical, tangible impact for its clients.

The role is focused on development environments and automation, with a strong Infrastructure as Code component and integration into CI/CD pipelines.
The candidate must be comfortable with DevOps / development practices, with application security extending these skills.

Language and location
Language: French
Location: Switzerland, Canton of Vaud

​

Required skills

• Minimum 5 years’ experience in development / DevOps / DevSecOps

• Hands-on experience, minimum 2 years, with Terraform + Cloudflare WAF or Akamai / Fastly (mandatory)

• Infrastructure as Code (Terraform)

• Good command of development environments (CI/CD, Git, pipelines)

• HTTP/HTTPS, APIs, architectures web

• Cloudflare (WAF, Rules, Workers – un plus)

• Firewall Rules, Rate Limiting

• DNS Management

• SSL/TLS

• Logging & Monitoring

• Knowledge of web security concepts (OWASP Top 10 – practical level sufficient)

​

Responsibilities

• Develop and maintain Cloudflare configurations using Terraform

• Integrate security controls into CI/CD pipelines using a DevSecOps approach

• Create and optimise WAF rules

• Implement application protections (WAF, rate limiting, API protection)

• Automate deployments and configuration management

• Analyse logs and events to improve the configuration

• Work closely with development and DevOps teams

• Contribute to the industrialisation of AppSec practices within development environments

Candidate profile

• Comfortable with code, automation and pipelines

• Able to understand and secure web applications throughout their development lifecycle

• Pragmatic, delivery-oriented and integration-focused

​

SKILLS

Cloudflare, Cloudflare WAF, Akamai WAF, Terraform, IaC, DevSecOps, CI/CD, Git, Web Security, API, HTTP/HTTPS, DNS, SSL/TLS, Rate Limiting, Firewall Rules, Cloud Security