Hybrid DevSecOps SCA Engineer | SBOM & Secure CI/CD

BMA Group Global; San Juan (PR); Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Relocation assistance

Hybrid work model

Job summary

BMA Group Global is seeking an experienced DevSecOps SCA Engineer to strengthen software supply chain security through automation, vulnerability management, and secure CI/CD practices. The role focuses on integrating SBOM, SPDX/CycloneDX, and SLSA standards into cloud-native development environments.

The ideal candidate will design secure pipelines, automate SBOM generation, and monitor security metrics with Grafana/Datadog while collaborating with engineering teams.

Qualifications

• Requires Bachelor's degree in Computer Science, Information Systems, or related field.
• 5–8 years of experience in DevSecOps, software development, or security engineering.
• Experience with SBOM, SCA tools, and software supply chain security.
• Strong knowledge of CI/CD pipelines, cloud-native technologies, and vulnerability management.
• Proficiency in Python, Go, Bash, or PowerShell.
• Familiarity with Grafana, Datadog, or similar monitoring tools.

Responsibilities

• Design and implement secure CI/CD pipelines with SCA and supply chain security controls.
• Automate SBOM generation, dependency tracking, and artifact signing.
• Manage vulnerabilities and ensure compliance with SPDX, CycloneDX, and SLSA standards.
• Collaborate with engineering and security teams to improve security practices.
• Develop monitoring dashboards and automate security reporting.

Skills

DevSecOps

CI/CD pipelines

SBOM

SCA tools

Python/Go/Bash/PowerShell

Monitoring tools (Grafana/Datadog)

Education

Bachelor's degree in Computer Science/IS

Tools

SCA tools (Trivy/Black Duck)

Monitoring tools (Grafana/Datadog)

Job description

BMA Group Global is seeking an experienced DevSecOps SCA Engineer to strengthen software supply chain security through automation, vulnerability management, and secure CI/CD practices. The role focuses on integrating SBOM, SPDX/CycloneDX, and SLSA standards into cloud-native development environments.

The ideal candidate will design secure pipelines, automate SBOM generation, and monitor security metrics with Grafana/Datadog while collaborating with engineering teams.