IT Engineering Services (DevSecOps) for the “armasuisse W+T” Cyber Defence Campus

Scope of work of the lots

• Lot 1 – IT Engineering Services (DevSecOps) – IT Software Development & A4 IT Site Reliability Engineeringshowhide

  Responsibilities

  · Developing secure software in accordance with secure coding standards (e.g. OWASP, NIST)

  · Use of LLM-powered development tools (e.g. GitHub Copilot, Amazon CodeWhisperer/Q Developer, Cursor, Claude, ChatGPT) to accelerate coding, refactoring and documentation – whilst adhering to defined usage guidelines

  · Implementation of CI/CD pipelines with security checks

  · Automation of unit tests, integration tests and security tests

  · Code reviews with a focus on security aspects

  · Implementation of Infrastructure-as-Code (IaC) with security policies

  · Use of Software Composition Analysis (SCA) to identify vulnerabilities in dependencies

  · Creation of secure APIs and microservices

  Details of Lot 1
• Lot 2 – IT Engineering Services (DevSecOps) – IT Platform Securityshowhide

  Responsibilities

  · Conducting threat analyses and risk assessments

  · Implementing and managing security policies and compliance requirements (e.g. ISO 27001, NIST, GDPR)

  · Automating security tests (e.g. Static Application Security Testing – SAST, Dynamic Application Security Testing – DAST)

  · Monitoring and analysing security incidents and anomalies

  · Implementing Identity and Access Management (IAM) solutions

  · Reviewing container and cloud security configurations (e.g. Kubernetes, Docker)

  · Introducing DevSecOps security training for developers and administrators

  Details of Lot 2
• Lot 3 – IT Engineering Services (DevSecOps) – IT Operations & A5 IT Infrastructureshowhide

  Responsibilities

  · Automation of infrastructure provisioning and configuration management (e.g. Terraform, Ansible, Nix)

  · Monitoring and logging of systems to detect anomalies (e.g. Prometheus, ELK Stack, Grafana)

  · Implementation and maintenance of Security Information and Event Management (SIEM) systems

  · Optimising container and cloud security (e.g. Kubernetes hardening, the principle of least privilege, AppArmor, SELinux)

  · Carrying out incident and problem management processes

  · Ensuring infrastructure performance optimisation and scalability

  · Patch management and vulnerability management within the infrastructure

  Details of Lot 3