DevSecOps & Supply Chain Security Consultant

Zappsec; Tewksbury, Northern (MA, KY); Hybrid; USD 150,000 - 210,000; Full time

Job summary

Zappsec seeks a DevSecOps & Supply Chain Security Consultant with 10+ years in secure software delivery to strengthen client programs in the US. You will assess SDLC maturity, SBOM governance, CI/CD controls, and vulnerability management, ensuring traceability and audit-ready findings.

Responsibilities include reviewing pipelines, secrets management, artifact integrity, and release governance, while producing remediation guidance and executive-ready reports for stakeholder buy-in.

Qualifications

• Strong understanding of DevSecOps and secure software delivery practices.
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling.
• Familiarity with CI/CD security controls and artifact integrity validation.
• Experience with vulnerability management and dependency governance programs.
• Understanding of lifecycle security, auditability, and compliance evidence requirements.
• Experience with secrets management and secure release governance.
• SBOM Analysis (CycloneDX, SPDX, VEX/CSAF)
• Artifact Integrity
• SAST/DAST and dependency & Secrets Scanning
• Vulnerability Management & Remediation Governance
• Secrets Management
• Compliance Evidence & Audit Traceability
• CRA / Regulatory Security Assessments
• Syft and SBOM tools
• Secure Release Governance & Security Controls Validation
• Build provenance and software-delivery traceability
• Artifact signing, verification and tamper testing
• Container, registry, build-agent and CI/CD runner security
• Infrastructure-as-Code and pipeline-as-code security
• Signing-key, certificate and HSM lifecycle controls
• SBOM generation and binary-to-SBOM reconciliation
• Open-source and third-party dependency governance
• EOL/EOS and patch-lifecycle governance
• Security exception and release-risk governance
• Pipeline policy-as-code and automated security gates
• Vulnerability metrics and release-readiness reporting
• NIST SSDF and secure software supply-chain practices
• Supplier security and software-acquisition assessments
• Tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins and Azure DevOps
• US Citizen or Green Card holder (US Person)

Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.
• Review SDLC processes, tooling, and secure development practices
• Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
• Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
• Review secrets management across development, build, deployment, and operational environments
• Assess logging, auditability, and security event traceability controls
• Evaluate vulnerability management, remediation tracking, and patch governance processes
• Support lifecycle security assessment, compliance evidence mapping, and traceability
• Contribute to assessment reporting, remediation guidance, and release governance reviews
• Validate source-to-release traceability, build provenance, tamper resistance, artifact signing and promotion controls, SBOM accuracy, security gates, exceptions, remediation decisions, release-readiness conclusions and residual-risk positions.
• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, stakeholder-ready executive communication and recommendations for finding-specific follow-up work.
• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls, infrastructure-as-code and pipeline-as-code security, policy-as-code implementation and automated security-gate effectiveness.

Skills

DevSecOps practices

SBOM frameworks

SCA tooling

CI/CD security controls

Artifact integrity

Vulnerability management

Secrets management

Secure release governance

Build provenance

Container security

IaC security

Signing and tamper testing

Open-source governance

NIST SSDF

SBOM tools

CI/CD tools

US Citizenship / US Person

Tools

Syft

Grype

Trivy

Gitleaks

Dependency-Track

OpenSSL

Cosign

Sigstore

GitHub Actions

GitLab CI

Jenkins

Azure DevOps

Job description

DevSecOps & Supply Chain Security Consultant

Role Summary

• Seeking a US Person with 10+ years of experience in secure software delivery, CI/CD and software supply-chain security.
• The role covers secure SDLC, pipeline architecture and access, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependencies, secrets, SAST/DAST, containers, IaC, vulnerability governance and regulatory evidence.
• The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions and remediation; produce audit-ready findings, release-readiness and residual-risk conclusions; and recommend finding-specific work. CRA, regulated-product and stakeholder-reporting experience is highly preferred.

Key Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.
• Review SDLC processes, tooling, and secure development practices
• Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
• Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
• Review secrets management across development, build, deployment, and operational environments
• Assess logging, auditability, and security event traceability controls
• Evaluate vulnerability management, remediation tracking, and patch governance processes
• Support lifecycle security assessment, compliance evidence mapping, and traceability
• Contribute to assessment reporting, remediation guidance, and release governance reviews
• Validate source-to-release traceability, build provenance, tamper resistance, artifact signing and promotion controls, SBOM accuracy, security gates, exceptions, remediation decisions, release-readiness conclusions and residual-risk positions.
• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, stakeholder-ready executive communication and recommendations for finding-specific follow-up work.
• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls, infrastructure-as-code and pipeline-as-code security, policy-as-code implementation and automated security-gate effectiveness.

Required Skills & Experience

Mandatory:

• Strong understanding of DevSecOps and secure software delivery practices
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling
• Familiarity with CI/CD security controls and artifact integrity validation
• Experience with vulnerability management and dependency governance programs
• Understanding of lifecycle security, auditability, and compliance evidence requirements
• Experience with secrets management and secure release governance
• SBOM Analysis (CycloneDX, SPDX, VEX/CSAF)
• Artifact Integrity
• SAST, DAST, Dependency & Secrets Scanning
• Vulnerability Management & Remediation Governance
• Secrets Management
• Compliance Evidence & Audit Traceability
• CRA / Regulatory Security Assessments
• Syft and related SBOM tools
• Secure Release Governance & Security Controls Validation
• Build provenance and software-delivery traceability
• Artifact signing, verification and tamper testing
• Container, registry, build-agent and CI/CD runner security
• Infrastructure-as-Code and pipeline-as-code security
• Signing-key, certificate and HSM lifecycle controls
• SBOM generation and binary-to-SBOM reconciliation
• Open-source and third-party dependency governance
• EOL/EOS and patch-lifecycle governance
• Security exception and release-risk governance
• Pipeline policy-as-code and automated security gates
• Vulnerability metrics and release-readiness reporting
• NIST SSDF and secure software supply-chain practices
• Supplier security and software-acquisition assessments
• Tools such as Syft, Grype, Trivy, Gitleaks, Dependency-Track, OpenSSL, Cosign, Sigstore, GitHub Actions, GitLab CI, Jenkins and Azure DevOps
• US Citizen or Green Card holder (US Person)

Good to have:

• Experience participating in CRA or regulated product security, or compliance-driven cybersecurity assessments
• Experience participating in engagement related to export-controlled environments
• Familiarity with SLSA or modern software supply chain security practices
• Strong documentation skills

Preferred Certifications

• CSSLP, Certified DevSecOps Professional or any other relevant product-security credentials

Years of Required Experience

• 10+ years in secure CI/CD pipeline setup, governance and controls validation, including setting up, maintaining and validating Secure CI/CD pipelines across different types of technology stacks.
• 2+ years of hands-on SBOM analysis experience.