Secure Build, Release & Supply-Chain Engineer IRC308347

GlobalLogic Latinoamérica; Poland; On-site; PLN 180,000 - 260,000; Full time

Job summary

GlobalLogic in Szczecin, Poland is seeking a Secure Build, Release & Supply-Chain Engineer to own software supply-chain integrity and secure release management across our engineering platforms.

You will design reproducible builds, enforce trusted sources, manage private registries, generate SBOMs, implement artifact signing, and establish policy gates for production releases.

Qualifications

• 5+ years of experience in build and release engineering, DevSecOps, or software supply-chain security.
• Hands-on with multi-language builds, dependencies, packaging, and reproducible builds.
• Experience securing private artifact repositories and container registries.
• Experience SBOM generation, provenance tracking, and artifact signing.
• Strong Linux administration, Git workflows, and CI/CD platforms.
• Scripting in Python and Bash for automation.

Responsibilities

• Establish end-to-end software supply-chain controls including SBOMs.
• Architect reproducible build pipelines and hardened build environments.
• Manage trusted feeds and private registries for audits and releases.
• Implement automated verification, scanning, and policy gates for artifacts.
• Maintain tamper-evident audit trails and artifact lineage.

Skills

ArgoCD

Bash

CI/CD Tools

Docker

Git

GitLab

Jenkins

Kubernetes

Linux

Python

Tools

Harbor

Nexus

Artifactory

Job description

Secure Build, Release & Supply-Chain Engineer IRC308347

Function

Engineering & Science

Experience

5-10 years

Location

Poland - Szczecin

Skills

ArgoCD, Bash, CI/CD Tools, Docker, Git, GitLab, Jenkins, Kubernetes, Linux, Python

We are looking for a Secure Build, Release & Supply-Chain Engineer to take complete ownership of software supply-chain integrity and secure release management across our engineering platforms. In this role, you will design and enforce reproducible builds, secure trusted package sources, manage private registries, generate and verify Software Bills of Materials (SBOMs), implement artifact signing and provenance, and establish policy gates for audit-ready artifact promotion and production releases.

Requirements

Must-Have Requirements

• 5+ years of experience in build and release engineering, DevSecOps, CI/CD platform engineering, or software supply-chain security.
• Build Systems & Compilation: Hands-on experience debugging and orchestrating multi-language compilation pipelines, dependency resolution, packaging systems, and reproducible builds.
• Registry & Package Management: In-depth experience administering and securing private artifact repositories and container registries (e.g., Harbor, Sonatype Nexus, JFrog Artifactory).
• Supply-Chain Controls: Practical expertise implementing SBOM generation and analysis, provenance tracking, vulnerability/secrets scanning, image signing, and verification gates.
• Core DevOps & Platform Fundamentals: Strong proficiency in Linux systems administration, advanced Git workflows, containerization (Docker), and CI/CD platforms (e.g., GitLab CI, Jenkins).
• Scripting & Automation: Strong scripting abilities in Python and Bash to build resilient release and verification automation.

Nice-to-Have Skills

• Security Frameworks: Practical knowledge of the SLSA (Supply-chain Levels for Software Artifacts) framework and implementing its requirements across build levels.
• Signing & Policy-as-Code: Direct experience with Cosign (Sigstore), Open Policy Agent (OPA), or Conftest for admission control and signature enforcement.
• Modern Container Build Tools: Experience with isolated, daemonless container build tools like BuildKit or Kaniko.
• Cloud-Native Delivery: Familiarity with Tekton pipelines, Kubernetes, Helm, and ArgoCD for declarative deployments.
• Secrets & Compliance: Experience integrating enterprise secrets management (e.g., HashiCorp Vault) and generating automated compliance/audit reports.

Job responsibilities

• Supply-Chain Integrity & Attestation: Establish and enforce end-to-end software supply-chain controls, including generating cryptographic provenance (SLSA framework), producing comprehensive SBOMs, and implementing artifact signing.
• Build System & Pipeline Hardening: Architect reproducible build pipelines, isolate build environments using tools like BuildKit or Kaniko, and eliminate hidden compiler or environment assumptions across multi-language projects.
• Artifact Lifecycle & Promotion: Manage trusted package feeds, secure private artifact registries (Harbor, Nexus, Artifactory), and build automated, audit-ready promotion pipelines and release runbooks.
• Automated Policy Gates & Admission Controls: Implement automated verification mechanisms, static and vulnerability scanning (SCA, container, secrets), and admission policy enforcement to block unvetted or untrusted artifacts.
• Audit & Compliance Readiness: Maintain tamper-evident audit trails, artifact lineage records, and evidence generation workflows to satisfy compliance standards.

What we offer

Empowering Projects: With 500+ clients spanning diverse industries and domains, we provide an exciting opportunity to contribute to groundbreaking projects that leverage cutting-edge technologies. As a team, we engineer digital products that positively impact people’s lives.

Empowering Growth: We foster a culture of continuous learning and professional development. Our dedication is to provide timely and comprehensive assistance for every consultant through our dedicated Learning & Development team, ensuring their continuous growth and success.

DE&I Matters: At GlobalLogic, we deeply value and embrace diversity. We are dedicated to providing equal opportunities for all individuals, fostering an inclusive and empowering work environment.

Career Development: Our corporate culture places a strong emphasis on career development, offering abundant opportunities for growth. Regular interactions with our teams ensure their engagement, motivation, and recognition. We empower our team members to pursue their career goals with confidence and enthusiasm.

Comprehensive Benefits: In addition to equitable compensation, we provide a comprehensive benefits package that prioritizes the overall well-being of our consultants. We genuinely care about their health and strive to create a positive work environment.

Flexible Opportunities: At GlobalLogic, we prioritize work-life balance by offering flexible opportunities tailored to your lifestyle. Explore relocation and rotation options for diverse cultural and professional experiences in different countries with our company.

About GlobalLogic

GlobalLogic, a Hitachi Group Company, is a trusted digital engineering partner to the world’s largest and most forward-thinking companies. Since 2000, we’ve been at the forefront of the digital revolution – helping create some of the most innovative and widely used digital products and experiences. Today we continue to collaborate with clients in transforming businesses and redefining industries through intelligent products, platforms, and services.