Remuneration
Not specified
Location
United States
Visa sponsorship
Sponsors visa
Job summary
The DevSecOps Engineer role is responsible for leading the design and implementation of secure software supply chain initiatives. Key responsibilities include enhancing artifact management, automating approval workflows, and integrating security tools into CI/CD pipelines, with a focus on AWS services and software supply chain security frameworks.
Qualifications
- Minimum 9+ years of experience in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.
- Hands-on experience with Sonatype Lifecycle and Nexus Repository.
- Experience creating and maintaining automated Open-Source Software Evaluation policies.
- Experience implementing artifact signing technologies such as Sigstore/Cosign.
- Strong understanding of SLSA provenance and software supply chain security frameworks.
- Experience with SBOM generation tools and standards, including CycloneDX and SPDX.
- CI/CD experience with GitLab or comparable platforms.
- Strong AWS experience across IAM, ECS/EKS, EC2, S3, Lambda, and CloudWatch.
- Experience integrating security tools into CI/CD pipelines.
- Strong scripting and automation skills using Python, Bash, or Go.
- Experience designing and maintaining enterprise Open-Source platforms.
- Familiarity with OCI registries and package ecosystems.
- Knowledge of NIST SSDF and Secure by Design initiatives.
Responsibilities
- Lead the design and enablement of enterprise software supply chain initiatives.
- Enhance Sonatype Repository artifact management and open-source software lifecycle processes.
- Define and automate software approval workflows and lifecycle management practices.
- Design repository proxy strategies across supported software ecosystems.
- Drive dependency upgrade initiatives and vulnerability remediation workflows.
- Support the design and onboarding of emerging ecosystems, including AI/ML frameworks.
- Design reporting and metrics capabilities to measure software supply chain health.
- Design CI/CD artifact signing and verification capabilities for software builds.
- Implement SLSA build provenance and attestation frameworks across CI/CD platforms.
- Integrate SBOM generation and software metadata into build and deployment pipelines.
- Collaborate with security and development teams to enhance software supply chain visibility.
Skills
AWSBashCloudWatchCosignECSEKSGitHubGitHub ActionsGitLabGoIAMAWS LambdaMavenNexusNotarynpmOracle CloudPythonS3Sigstore
Relocation
No