DevSecOps Engineer

System One, Inc.; Birmingham (AL); Hybrid; USD 105,000 - 145,000; Full time

Job summary

System One is seeking a DevSecOps Engineer to strengthen our software supply chain security program within a large-scale AWS-based financial services environment. You will secure the software delivery lifecycle from open source governance to artifact integrity, ensuring compliance and security across the organization.

You will work hands-on with Nexus/IQ, implement SLSA and Cosign-based signing, and build automation for SBOM generation, vulnerability remediation, and policy enforcement.

Qualifications

• 5+ years in DevSecOps, platform engineering, or software supply chain roles.
• Hands-on with Nexus and IQ Server (or Artifactory) for security tooling.
• Experience building automated open source policy workflows.
• Experience with artifact signing tools like Sigstore/Cosign, GPG, or Notary.
• Familiar with SLSA provenance and attestations.
• SBOM generation using CycloneDX, SPDX, or Syft.
• Strong CI/CD background with GitLab; GitHub Actions is a plus.
• Strong AWS skills: IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, CloudWatch.
• Scripting in Python, Bash, or Go.
• Exposure to OCI registries and package ecosystems Maven, npm, PyPI, NuGet.
• Bachelor's degree in CS/IS or related field.

Responsibilities

• Support secure software delivery through enterprise supply chain initiatives.
• Manage and enhance artifact repository tooling and open source policy governance.
• Build and maintain software approval, quarantine, and lifecycle workflows.
• Drive dependency upgrades and vulnerability remediation efforts.
• Onboard new/emerging technology ecosystems (including AI/ML frameworks).
• Create dashboards and metrics for supply chain health and compliance.
• Implement CI/CD artifact signing, build provenance (SLSA), and SBOM integration.

Skills

DevSecOps experience

Platform engineering

Software supply chain

Nexus IQ

JFrog Artifactory

Artifact signing

Sigstore Cosign

GPG

Notary

SBOM

SLSA

CycloneDX

SPDX

Syft

GitLab

GitHub Actions

AWS

IAM

ECS/EKS

EC2

S3

Lambda

Step Functions

CloudWatch

Python

Bash

Go

OCI registries

Maven

npm

PyPI

NuGet

Education

Bachelor's degree in Computer Science or Information Systems

Tools

Sonatype Nexus

IQ Server

JFrog Artifactory

Sigstore Cosign

GPG

Notary

CycloneDX

SPDX

Syft

GitLab

GitHub Actions

Maven

npm

PyPI

NuGet

OCI registries

Python

Bash

Go

AWS

Job description

Job Title: DevSecOps Engineer

Location: Birmingham, AL

Type: Permanent Full Time

Compensation: Not specified

Work Model: Hybrid - onsite and remote

Hours: 40.0

Security Clearance: Not specified in the provided details

Overview

We are seeking a DevSecOps Engineer to strengthen our software supply chain security program within a large scale, AWS based financial services environment. In this role, you will help secure the software delivery lifecycle - from open source governance to CI/CD artifact integrity - ensuring that software built and deployed across the organization meets rigorous compliance and security standards.

You’ll work hands on with tools like Sonatype Nexus/IQ Server, implement artifact signing and provenance frameworks (SLSA, Sigstore/Cosign), and build automation that supports vulnerability remediation, SBOM generation, and open source policy enforcement. This is a great opportunity for someone who enjoys solving real security problems at scale, working across CI/CD pipelines, cloud infrastructure, and emerging technology ecosystems (including AI/ML tooling).

This position is required in one of the following locations: Lafayette, LA, Knoxville, TN, Birmingham, AL

Responsibilities

• Support secure software delivery through enterprise supply chain initiatives
• Manage and enhance artifact repository tooling and open source policy governance
• Build and maintain software approval, quarantine, and lifecycle workflows
• Drive dependency upgrades and vulnerability remediation efforts
• Onboard new/emerging technology ecosystems (including AI/ML frameworks)
• Create dashboards and metrics for supply chain health and compliance
• Implement CI/CD artifact signing, build provenance (SLSA), and SBOM integration

Requirements

• 5+ years working in DevSecOps, Platform Engineering, or Software Supply Chain roles
• Hands on experience with Sonatype Nexus and IQ Server (or similar - jFrog Artifactory is fine too)
• Comfortable building and maintaining automated open source policy workflows
• Experience with artifact signing tools like Sigstore/Cosign, GPG, or Notary
• Familiarity with SLSA provenance and in toto attestations (or similar supply chain security frameworks)
• Know your way around SBOM generation tools - CycloneDX, SPDX, or Syft
• Solid CI/CD background, ideally with GitLab (GitHub Actions also welcome)
• Strong AWS chops - IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, CloudWatch
• Scripting ability in Python, Bash, or Go
• Exposure to OCI registries and package ecosystems like Maven, npm, PyPI, or NuGet
• Bachelor's degree in Computer Science, Information Systems, or a related field

System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.

#LI-
Ref: #404-IT Pittsburgh