TEMP Principal DevOps Engineer

Role Purpose 

A temporary (6 Months) contractor to support the Bologna and Taino (Altanova) engineering teams in migrating their desktop-application and firmware CI pipelines from GitLab/SVN/Jenkins/ADO into Doble’s common Azure DevOps environment, while strengthening product-security practices required by the EU Cyber Resilience Act (CRA) and the IEC 62443-4-1 secure-development lifecycle. The contractor will embed threat modeling, Snyk scanning, and SBOM generation directly into the migrated pipelines so that CRA/CE technical evidence is produced as a by-product of day-to-day engineering.

Essential Functions — DevOps & CI Migration 

• Design and build Azure DevOps multi-stage YAML pipelines, repos, service connections, agent pools, and variable/secret groups for the migrated teams. 

• Execute source-control migration from GitLab, SVN, and Bitbucket into Azure DevOps Git, including history, and advise on project/repo structuring (project-per-product vs. multi-repo). 

• Support desktop / thick-client and firmware builds — C/C++, .NET, FPGA toolchains, code-signing, and Yocto / embedded-Linux build servers in Azure. 

• Containerize and manage build/scan workflows using Docker, AKS, and Azure Container Registry. 

• Provide CI support for monolith-to-microservices refactoring (strangler pattern), standing up per-microservice pipelines. 

• Create reusable pipeline templates so the common environment is consistent across teams; manage infrastructure with Terraform. 

Essential Functions — Security, Threat Modeling & CRA 

• Perform threat modeling using STRIDE (plus attack trees / MITRE ATT&CK for ICS where appropriate), producing data-flow diagrams with trust boundaries during the requirements/design phase. 

• Threat models must cover information flows, trust boundaries, data stores, external entities, comms protocols, externally accessible physical/debug ports, JTAG/debug headers and hardware attack vectors, CVSS-scored threats, and documented mitigations — aligned to IEC 62443-4-1 SR-2. 

• Build a reusable threat-model template and repeatable process, and feed outputs into CRA risk assessments (asset ID threat modeling risk evaluation) and Stage-Gate / Jira / ADO traceability. 

• Configure and operate Snyk — Snyk Code (SAST), Open Source (SCA), Container, and SBOM — as pipeline stages in ADO/Jenkins, set severity gates, and onboard new repos to raise coverage. 

• Add automated SBOM generation (CycloneDX/SPDX, machine-readable, per release) to each migrated pipeline. 

• Harden pipelines: move secrets to Azure Key Vault (no hard-coded credentials), secure service connections, enforce least-privilege on ADO/AKS. 

• Validate that mitigations work (SVV-2 threat-mitigation testing) and produce audit-trail artifacts (scan results, threat models, SBOMs, test records) for the CRA Annex VII technical file. 

Requirements Summary — Must vs. Preferred vs. Nice-to-Have 

Minimum Qualifications 

• 5+ years in DevOps / CI-CD engineering with hands-on Azure DevOps Pipelines and Git-based source-control migration. 

• Demonstrated experience building desktop/firmware or embedded build pipelines (not web-only). 

• Working knowledge of Snyk (or equivalent SAST/SCA), SBOM generation, and STRIDE threat modeling. 

• Familiarity with the EU CRA and IEC 62443-4-1 secure-development lifecycle concepts. 

• English working proficiency; Italian a strong plus given the mixed-language migration meetings.