DevSecOps & Supply Chain Security Consultant - Zappsec

OpenTalent; Tewksbury (MA); On-site; USD 140,000 - 200,000; Full time

Job summary

OpenTalent seeks a DevSecOps & Supply Chain Security Consultant in the US (MA) with 10+ years of experience in secure software delivery, CI/CD, and software supply-chain security. You will validate source-to-release traceability, SBOM accuracy, and security gates while supporting audit-ready findings and remediation guidance.

The role covers pipeline architecture, artifact signing, and governance across IaC, containers, and regulatory evidence; CRA or regulated-product exposure is preferred.

Qualifications

• Strong understanding of DevSecOps and secure software delivery practices.
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling.
• Familiarity with CI/CD security controls and artifact integrity validation.
• Experience with vulnerability management and dependency governance programs.

Responsibilities

• Assess software supply chain security and SDLC maturity.
• Review CI/CD tooling and secure development practices.
• Evaluate SBOM governance and dependency management.
• Assess pipeline security, artifact integrity, and release controls.
• Review secrets management across dev, build, and ops.
• Check logging, auditability, and security event traces.
• Evaluate vulnerability management and patch governance.
• Support evidence mapping and traceability for compliance.
• Produce audit-ready findings and executive summaries.

Skills

DevSecOps

SBOM frameworks

CI/CD security

Vulnerability management

Tools

CycloneDX

SPDX

Job description

DevSecOps & Supply Chain Security Consultant

Role Summary

• Seeking a US Person with 10+ years of experience in secure software delivery, CI/CD and software supply-chain security.
• The role covers secure SDLC, pipeline architecture and access, build provenance, artifact signing and promotion, SBOM/VEX/CSAF, dependencies, secrets, SAST/DAST, containers, IaC, vulnerability governance and regulatory evidence.
• The consultant will validate source-to-release traceability, tamper resistance, SBOM accuracy, security gates, exceptions and remediation; produce audit-ready findings, release-readiness and residual-risk conclusions; and recommend finding-specific work. CRA, regulated-product and stakeholder-reporting experience is highly preferred.

Key Responsibilities

• Assess software supply chain security, SDLC maturity, SBOM governance, CI/CD pipeline controls, secrets management, logging/auditability, and vulnerability management to support lifecycle security evaluation and compliance traceability.
• Review SDLC processes, tooling, and secure development practices
• Assess software supply chain security, including SCA, SBOM accuracy/completeness, dependency governance, and third-party risk
• Evaluate CI/CD pipeline security, artifact integrity, and secure release controls
• Review secrets management across development, build, deployment, and operational environments
• Assess logging, auditability, and security event traceability controls
• Evaluate vulnerability management, remediation tracking, and patch governance processes
• Support lifecycle security assessment, compliance evidence mapping, and traceability
• Contribute to assessment reporting, remediation guidance, and release governance reviews
• Validate source-to-release traceability, build provenance, tamper resistance, artifact signing and promotion controls, SBOM accuracy, security gates, exceptions, remediation decisions, release-readiness conclusions and residual-risk positions.
• Produce audit-ready findings, release-readiness reporting, residual-risk conclusions, stakeholder-ready executive communication and recommendations for finding-specific follow-up work.
• Assess pipeline architecture and access, build-agent and CI/CD runner security, container and registry controls, infrastructure-as-code and pipeline-as-code security, policy-as-code implementation and automated security-gate effectiveness.

Required Skills & Experience

Mandatory:

• Strong understanding of DevSecOps and secure software delivery practices
• Experience with SBOM frameworks (CycloneDX, SPDX) and SCA tooling
• Familiarity with CI/CD security controls and artifact integrity validation
• Experience with vulnerability management and dependency governance programs