DevSecOps & Supply Chain Security Consultant

Rivago Infotech Inc; Tewksbury (MA); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Rivago Infotech Inc in the United States is seeking a DevSecOps & Supply Chain Security Consultant to assess software supply chain security, SBOM governance, and CI/CD controls across development and deployment environments.

You will review SDLC practices, vulnerability management, secrets handling, and release governance while mapping compliance evidence and providing remediation guidance to stakeholders.

Qualifications

• Strong DevSecOps and secure software delivery expertise.
• Experience with CycloneDX/ SPDX SBOMs and SCA tooling.
• Familiarity with CI/CD security controls and artifact validation.

Responsibilities

• Review SDLC processes and secure development practices.
• Assess software supply chain security including SBOM accuracy and dependency governance.
• Evaluate CI/CD pipeline security and artifact integrity.
• Review secrets management across environments.
• Assess logging, auditability, and security event traceability.
• Evaluate vulnerability management and patch governance.
• Support lifecycle security assessment and traceability.
• Contribute to assessment reporting and remediation guidance.
• Participate in release governance reviews.

Skills

DevSecOps

SBOM frameworks

SCA tooling

CI/CD security

Vulnerability management

Dependency governance

Auditability

Secrets management

Release governance

Lifecycle security

Tools

CycloneDX

SPDX

CI/CD tooling

Vulnerability scanners

Job description

Role: DevSecOps & Supply Chain Security Consultant

Work Location: Tewksbury, MA 01876 (Remote)

Role Summary

Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.

Key Responsibilities

• Review SDLC processes, tooling, and secure development practices
• Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
• Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
• Review secrets management across development, build, deployment, and operational environments
• Assess logging, auditability, and security event traceability controls
• Evaluate vulnerability management, remediation tracking, and patch governance processes
• Support lifecycle security assessment, compliance evidence mapping, and traceability
• Contribute to assessment reporting, remediation guidance, and release governance reviews

Required Skills & Experience

Mandatory:

• Strong understanding of DevSecOps and secure software delivery practices
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling
• Familiarity with CI/CD security controls and artifact integrity validation
• Experience with vulnerability management and dependency governance programs
• Understanding of lifecycle security, auditability, and compliance evidence requirements
• Experience with secrets management and secure release governance

Good to have:

• Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments
• Experience participating in engagement related to export-controlled environments

Preferred Certifications

• Kubernetes / Cloud Security certifications preferred
• DevSecOps or secure software supply chain experience preferred
• Familiarity with SLSA or modern software supply chain security practices
• Clearance / Compliance Requirements

Years of Required Experience:

7-10 years in setting up, maintaining and controls validation of Secure. CI/CD pipelines across different type of tech stack.