Hybrid DevSecOps SCA Engineer — SBOM & CI/CD

Hewlett Packard Enterprise; San Juan (PR); Hybrid; USD 100.000 - 140.000; Vollzeit

Benefits dieser Stelle

Relocation support

Hybrid work arrangement

Zusammenfassung

Hewlett Packard Enterprise in Puerto Rico seeks a DevSecOps SCA Engineer to join our hybrid team, working on-site roughly two days per week. You will design, implement, and maintain software supply chain security solutions, SBOM generation, and CI/CD integration.

Responsibilities include enforcing SBOM quality, integrating SCA tools like Trivy or BlackDuck, collaborating with security and engineering teams, and producing dashboards to monitor posture.

Qualifikationen

• Bachelor’s or Master’s degree in Computer Science, Information Systems, or equivalent.
• 5–8 years of experience in software development, security engineering, DevSecOps, or platform engineering roles with a focus on security and supply chain integrity.
• Hands-on experience with SBOM standards such as SPDX and CycloneDX.
• Strong understanding of software supply chain security concepts including SLSA, provenance, artifact integrity, and signing.
• Proficiency with supply chain security tooling such as Trivy, BlackDuck, or similar SCA tools; experience with Grafana, Datadog, or similar monitoring tools.
• Familiarity with cloud-native architectures and CI/CD ecosystems.
• Scripting and automation skills in languages like Python, Go, Bash, or PowerShell.
• Excellent communication skills for engaging both technical and non-technical stakeholders.
• Strong analytical, problem-solving, and testing methodology knowledge, including writing and executing test plans, debugging, and scripting.

Aufgaben

• Lead the design, development, and maintenance of software solutions, including enhancements, updates, and programming changes for system software, utilities, and security tools.
• Develop and operate automated pipelines for SBOM generation during build and release processes for containerized and non-containerized applications.
• Integrate SCA, dependency tracking, artifact signing, and supply chain security controls into CI/CD pipelines.
• Define and enforce policies for SBOM quality, format compliance (SPDX, CycloneDX), and attestations.
• Collaborate with engineering, security, and compliance teams on vulnerability triage, exception handling, and audit readiness.
• Analyze system designs and determine coding, integration, and testing activities based on project objectives and architecture.
• Write and execute comprehensive test plans, protocols, and documentation; debug and resolve issues related to code, integration, and security controls.
• Lead cross-functional project teams to deliver reliable, cost-effective, and high-quality solutions.
• Develop dashboards and reports to monitor supply chain posture, SLA adherence, and provide executive insights.

Kenntnisse

SBOM standards

SCA tooling

CI/CD pipelines

Cloud-native

Scripting (Python/Go/Bash)

Communication

Testing methodologies

Ausbildung

Bachelor's or Master's in CS/IS or equivalent

Tools

Trivy

BlackDuck

Grafana

Datadog

Jobbeschreibung

Hewlett Packard Enterprise in Puerto Rico seeks a DevSecOps SCA Engineer to join our hybrid team, working on-site roughly two days per week. You will design, implement, and maintain software supply chain security solutions, SBOM generation, and CI/CD integration.

Responsibilities include enforcing SBOM quality, integrating SCA tools like Trivy or BlackDuck, collaborating with security and engineering teams, and producing dashboards to monitor posture.