Senior DevSecOps Engineer — Software Supply Chain

State Street; Hong Kong; On-site; HKD 784,000 - 1,314,000; Full time

Benefits offered by this job

Healthcare benefits included

Job summary

State Street is seeking an accomplished cybersecurity professional for its Architecture & Engineering team, focusing on Application Security and software supply chain governance. The role requires hands-on AppSec, SSDLC, and secure pipeline automation within CI/CD, plus managing artifact caches at enterprise scale.

You will help implement DevSecOps across engineering teams, automate security tooling and reporting, and contribute to policy and documentation.

Qualifications

• 6+ years of combined experience in development, CI/CD, software supply chain security and AppSec.
• Experience with application security tooling in modern CI/CD and DevSecOps practices.
• Experience partnering with Dev community to influence adoption of security practices and tooling.
• Security+ or other cybersecurity certification.

Responsibilities

• Execute software supply chain security strategy to enable secure-by-default open source artifacts across the enterprise.
• Partner with Engineering leads to implement DevSecOps and AppSec principles and processes.
• Assist application teams onboarding to security tools; troubleshoot integrations with vendors.
• Deliver and communicate reporting via dashboards and metrics.
• Develop and maintain supply chain security and DevSecOps documentation.
• Improve DevSecOps and Software Supply Chain Security processes and tools across teams.
• Deliver tasks aligned with project objectives and support projects to completion.

Skills

Java

.NET

Python

Node.js

CI/CD

DevSecOps

AppSec

JFrog Artifactory

Artifact management

Ansible

Terraform

Kubernetes

IaC

Cloud Security

Cybersecurity

Agile/DevOps

Communication

Project management

Education

Security+ certification

Tools

JFrog Artifactory

Job description

State Street is seeking an accomplished cybersecurity professional for its Architecture & Engineering team, focusing on Application Security and software supply chain governance. The role requires hands-on AppSec, SSDLC, and secure pipeline automation within CI/CD, plus managing artifact caches at enterprise scale.

You will help implement DevSecOps across engineering teams, automate security tooling and reporting, and contribute to policy and documentation.