Remote DevSecOps Architect – Software Supply Chain Security

NEW ERA TECHNOLOGY; Tinton Falls (NJ); A distancia; USD 140.000 - 190.000; Jornada completa

Descripción de la vacante

New Era Technology is seeking a hands-on DevSecOps Architect specializing in Software Supply Chain Security. You will secure CI/CD pipelines, manage SBOMs, and implement provenance verification across GitHub/GitLab, software build, and deployment environments. Remote work with overlap with US hours is expected.

The role emphasizes security-as-code, policy-as-code, and compliance alignment with NIST standards while collaborating with security, engineering, platform, and compliance teams.

Formación

• 5–8 years of DevSecOps, app security, or platform engineering with CI/CD security ownership.
• Hands-on experience with GitHub Actions and GitLab pipelines at scale.
• Experience generating and managing SBOMs (SPDX/CycloneDX).
• Knowledge of SLSA, NIST SSDF, NIST SP 800-218.
• Experience with artifact signing and provenance verification tools.

Responsabilidades

• Design and implement software supply chain security controls across build/release pipelines.
• Secure GitHub and GitLab environments, including branch protection and provenance attestation.
• Implement SBOM generation, validation, and distribution using SBOM formats.
• Integrate dependency scanning and vulnerability management into CI/CD pipelines.
• Implement artifact signing and verification using Sigstore, Cosign, or in-toto.
• Develop security-as-code and policy-as-code controls using OPA, Kyverno, or Conftest.
• Secure Kubernetes-based build and deployment environments.
• Conduct threat modeling for CI/CD pipelines, infrastructure, and AI-assisted development.
• Assess risks from open-source dependencies and AI-generated code.
• Align security practices with NIST SSDF and 800-218; produce runbooks and audit evidence.

Conocimientos

CI/CD security

GitHub Actions

GitLab pipelines

SBOM management

SBOM generation

Vulnerability management

Kubernetes security

Policy-as-code

Python scripting

Threat modeling

Educación

Bachelor's degree in Computer Science, Information Security, Engineering, or related field

Herramientas

Sigstore

Cosign

in-toto

Syft

CycloneDX

SPDX

Open Policy Agent

Kyverno

Conftest

Descripción del empleo

New Era Technology is seeking a hands-on DevSecOps Architect specializing in Software Supply Chain Security. You will secure CI/CD pipelines, manage SBOMs, and implement provenance verification across GitHub/GitLab, software build, and deployment environments. Remote work with overlap with US hours is expected.

The role emphasizes security-as-code, policy-as-code, and compliance alignment with NIST standards while collaborating with security, engineering, platform, and compliance teams.