OSS-SIRT Engineer Lead: Open Source Security & Automation

The Linux Foundation; United States; On-site; USD 170,000 - 185,000; Full time

Job summary

The Linux Foundation is seeking a Senior OSS-SIRT Engineer to serve as the technical authority for vulnerability triage, tooling, and automation across OSS projects. You will lead OSV-based triage workflows, design ingestion pipelines, and coordinate with maintainers and researchers on complex disclosures, while aligning with OSV Schema, CWE, CVSS/EPSS, VEX, and SBOM formats.

Candidates should have 8+ years in security engineering or PSIRT, hands-on OSS vulnerability disclosure, and scripting

Qualifications

• 8+ years in security engineering, PSIRT, or vulnerability research roles.
• Hands-on experience with OSS vulnerability disclosure and triage.
• Strong understanding of software supply chain security.

Responsibilities

• Lead vulnerability triage and validation using OSV-based workflows
• Design and improve ingestion, linting, and curation pipelines
• Coordinate with maintainers, researchers, and CNAs on complex disclosures
• Develop and maintain automation tooling (APIs, CLIs, GitHub Actions, CI hooks)
• Ensure alignment with OSV Schema, CWE, CVSS/EPSS, VEX, and SBOM formats
• Support incident response for high-severity, multi-project vulnerabilities
• Provide technical guidance to the OSS-SIRT Director on feasibility and risk

Skills

Security engineering

Scripting (Python/Go)

Vulnerability disclosure

Tools

OSV

GitHub Advisories

SBOM tooling

Job description

The Linux Foundation is seeking a Senior OSS-SIRT Engineer to serve as the technical authority for vulnerability triage, tooling, and automation across OSS projects. You will lead OSV-based triage workflows, design ingestion pipelines, and coordinate with maintainers and researchers on complex disclosures, while aligning with OSV Schema, CWE, CVSS/EPSS, VEX, and SBOM formats.

Candidates should have 8+ years in security engineering or PSIRT, hands-on OSS vulnerability disclosure, and scripting