Secure Build & Release Engineer: Supply-Chain Integrity

GlobalLogic Inc.; Szczecin; On-site; PLN 260,000 - 380,000; Full time

Benefits offered by this job

Relocation options

Flexible opportunities

Career development

Learning & development support

Job summary

GlobalLogic, a Hitachi Group Company, is seeking a Secure Build, Release & Supply-Chain Engineer to own software supply-chain integrity in Szczecin, Poland. You will design reproducible builds, manage private registries, generate SBOMs, implement artifact signing and governance, and establish policy gates for audit-ready releases.

The role focuses on hardening build pipelines, SBOM generation, vulnerability scanning, and signing processes across multi-language projects, collaborating with DevOps

Qualifications

• 5+ years of experience in build and release engineering, DevSecOps, CI/CD platform engineering, or software supply-chain security.
• Hands-on experience debugging and orchestrating multi-language compilation pipelines, dependency resolution, packaging systems, and reproducible builds.
• In-depth experience administering and securing private artifact repositories and container registries (e.g., Harbor, Sonatype Nexus, JFrog Artifactory).
• Experience implementing SBOM generation and analysis, provenance tracking, vulnerability/secrets scanning, image signing, and verification gates.
• Strong Linux systems administration, advanced Git workflows, containerization (Docker), and CI/CD platforms (GitLab CI, Jenkins).
• Strong scripting in Python and Bash to build release/verification automation.

Responsibilities

• Establish and enforce end-to-end software supply-chain controls, including SBOMs and artifact signing.
• Architect reproducible build pipelines and isolate build environments using BuildKit or Kaniko.
• Manage trusted package feeds, secure private registries, and build automated, audit-ready promotion pipelines.
• Implement automated verification mechanisms, static and vulnerability scanning, and admission policy enforcement.
• Maintain tamper-evident audit trails and artifact lineage for compliance.

Skills

ArgoCD

Bash

CI/CD Tools

Docker

Git

GitLab

Jenkins

Kubernetes

Linux

Python

Tools

Harbor

Sonatype Nexus

JFrog Artifactory

BuildKit

Kaniko

Tekton

Cosign

Job description

GlobalLogic, a Hitachi Group Company, is seeking a Secure Build, Release & Supply-Chain Engineer to own software supply-chain integrity in Szczecin, Poland. You will design reproducible builds, manage private registries, generate SBOMs, implement artifact signing and governance, and establish policy gates for audit-ready releases.

The role focuses on hardening build pipelines, SBOM generation, vulnerability scanning, and signing processes across multi-language projects, collaborating with DevOps