OSS Security & Supply Chain Engineer

Crump Life Insurance Svcs Inc; Charlotte (NC); On-site; USD 105,000 - 130,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

Life insurance

Disability insurance

401(k) plan

Vacation days

Paid holidays

Job summary

Truist Financial Corporation in the United States seeks an Open Source Software (OSS) Security Engineer to lead practical OSS security across governance, engineering workflows, tooling, and risk reduction.

You will partner with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure OSS components and release processes are approved, continuously monitored, remediated, and securely integrated into enterprise applications and delivery pipelines.

Qualifications

• Bachelor’s degree or equivalent education, training, and work‑related experience.
• Minimum of 5 years of experience in security engineering or related cybersecurity roles.
• Advanced knowledge in cybersecurity principles, theories, and concepts.
• Proven experience in software development lifecycle security practices.
• Advanced knowledge of threat modeling, security testing, and penetration testing.
• Experience implementing and managing complex information security technologies.

Responsibilities

• Governance and Standards: Define policies, standards, and control requirements for approved open source usage, dependency hygiene, SBOM generation, secure package sourcing, and software supply chain risk management.
• Secure OSS Lifecycle Management: Establish processes for OSS intake, approval, tracking, ownership, version management, vulnerability remediation, end‑of‑life component retirement, and exception governance.
• CI/CD Preventative Controls: Work with CI/CD and platform engineering teams to design and implement automated security gates for curated OSS usage, dependency scanning, license checks, artifact validation, provenance controls, build‑time enforcement, and policy‑based blocking of high‑risk components.
• Software Supply Chain Risk Reduction: Identify and reduce risks related to vulnerable dependencies, malicious packages, dependency confusion, typosquatting, compromised maintainers, insecure build artifacts, and unauthorized package sources.
• Software Supply Chain Security: Establish controls for trusted package sources, dependency provenance, build integrity, artifact signing, repository hygiene, tamper resistance, and secure release practices.
• Threat Response and Incident Detection: Establish capabilities to rapidly identify, assess, and respond to open source supply chain threats, malicious package campaigns, zero‑day vulnerabilities, compromised dependencies, and software supply chain security incidents.
• Tooling and Automation: Support the deployment, tuning, and integration of software composition analysis, SBOM, package repository, vulnerability management, and developer workflow tools.
• Risk Reporting and Metrics: Develop reporting that measures OSS risk posture, remediation velocity, policy exceptions, adoption of preventative controls, and reduction of high‑risk dependencies.
• Developer Enablement: Create guidance, playbooks, reusable patterns, and consultation models that help engineering teams make secure open source decisions early in the lifecycle.

Skills

Security engineering

Software security

CI/CD security

SBOM

Threat modeling

DevSecOps

Automation

Python

Education

Bachelor’s degree or equivalent

Tools

CI/CD platforms

Security testing tools

Job description

Truist Financial Corporation in the United States seeks an Open Source Software (OSS) Security Engineer to lead practical OSS security across governance, engineering workflows, tooling, and risk reduction.

You will partner with CI/CD, DevSecOps, application security, engineering, platform, and risk teams to ensure OSS components and release processes are approved, continuously monitored, remediated, and securely integrated into enterprise applications and delivery pipelines.