Open Source Security Engineer - DevSecOps & SBOM Expert

Infosys; Raleigh (NC); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Disability benefits

Health & Dependent Care Accounts

Insurance options

401(k) plan

Job summary

Infosys is seeking an Engineering Consultant 2 to drive security-focused engineering initiatives in the Financial Services unit. You will elicit requirements, contribute to design discussions, and help implement secure software supply chains across banking, wealth, and insurance domains.

The role requires a strong background in DevSecOps, platform engineering, and OSS governance, with hands-on work in SBOMs, artifact signing, and cloud security tooling. Relocation/travel may be required.

Qualifications

• Experience in DevSecOps, Platform Engineering, or Software Supply Chain Security.
• Hands-on experience with Sonatype Lifecycle (IQ Server), Nexus Repository, or comparable solutions such as JFrog.
• Experience developing and managing OSS governance policies, evaluation workflows, and automation.
• Knowledge of artifact signing and integrity verification technologies, including Sigstore/Cosign, GPG, and Notary.
• Experience implementing SLSA provenance, in-toto attestations, and software supply chain security controls.
• Hands-on experience generating and managing SBOMs using CycloneDX, SPDX, or Syft.

Responsibilities

• Elicit and document business and technical requirements, translating them into actionable specifications for the team.
• Participate in design meetings, create initial design concepts, and support the development of design sketches and models.
• Participate in iterative engineering design cycles, refine prototypes, and coordinate with teams to implement feedback effectively.
• Develop and refine solution specifications and perform validation activities, including simulations.
• Build and refine prototypes, incorporating testing results and feedback from cross-functional teams.

Skills

DevSecOps

Platform engineering

Software supply chain security

CI/CD integration

Scripting (Python/Bash/Go)

Communication skills

Education

Bachelor's degree

Tools

Sonatype Lifecycle (IQ Server)

Nexus Repository

JFrog

Sigstore/Cosign

GPG

Notary

SBOM tooling: CycloneDX/SPDX/Syft

AWS cloud services (IAM,ECS/EKS,EC2,S3,Lambda,Step Functions,CloudWatch)

Job description

Infosys is seeking an Engineering Consultant 2 to drive security-focused engineering initiatives in the Financial Services unit. You will elicit requirements, contribute to design discussions, and help implement secure software supply chains across banking, wealth, and insurance domains.

The role requires a strong background in DevSecOps, platform engineering, and OSS governance, with hands-on work in SBOMs, artifact signing, and cloud security tooling. Relocation/travel may be required.