Remote DevSecOps Architect: Software Supply Chain Security

New Era Technology; United States; À distance; USD 130 000 - 190 000; Plein temps

Avantages offerts par ce poste

Health insurance

Résumé du poste

New Era Technology is seeking a hands-on DevSecOps Architect focused on Software Supply Chain Security to fortify build and release pipelines for client deployments. You will secure CI/CD workflows, manage SBOMs, enable artifact signing, and enforce provenance verification across Kubernetes environments.

The role emphasizes security controls across the software development lifecycle with hands-on implementation and collaboration with security, engineering, platform, and compliance teams.

Qualifications

• 5-8 years of experience in DevSecOps, application security, or platform engineering with CI/CD security ownership.
• Strong hands-on experience with GitHub Actions and GitLab pipelines in large-scale environments.
• Experience generating and managing SBOMs using SPDX or CycloneDX.
• Knowledge of SLSA, NIST SSDF, and NIST SP 800-218.
• Experience with artifact signing and verification tools such as Sigstore, Cosign, or in-toto.
• Hands-on Kubernetes security experience including admission control and network policies.
• Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.
• Understanding of threat modeling methodologies like STRIDE or attack trees.
• Scripting in Python, Bash, or Go; familiarity with Docker/OCI images and container registries.

Responsabilités

• Design and implement software supply chain security controls across build and release pipelines.
• Secure GitHub and GitLab environments, including branch protection and provenance attestation.
• Implement SBOM generation, validation, and distribution using SPDX/CycloneDX.
• Integrate dependency scanning and vulnerability management into CI/CD pipelines.
• Implement artifact signing and verification using Sigstore, Cosign, or in-toto.
• Develop and enforce security-as-code and policy-as-code controls with OPA, Kyverno, or Conftest.
• Secure Kubernetes-based build and deployment environments.
• Conduct threat modeling for CI/CD pipelines, infra, and AI-assisted development workflows.
• Assess risks of open-source dependencies and AI-generated code.

Description du poste

New Era Technology is seeking a hands-on DevSecOps Architect focused on Software Supply Chain Security to fortify build and release pipelines for client deployments. You will secure CI/CD workflows, manage SBOMs, enable artifact signing, and enforce provenance verification across Kubernetes environments.

The role emphasizes security controls across the software development lifecycle with hands-on implementation and collaboration with security, engineering, platform, and compliance teams.