Security Engineer II: Open-Source & Supply Chain (Remote)

CrowdStrike, Inc.; Virginia (IL); Remote; USD 100,000 - 145,000; Full time

Benefits offered by this job

Market leader compensation

Wellness programs

Vacation and holidays

Parental and adoption leaves

Professional development

Employee networks and volunteering

Vibrant office culture

Great Place to Work Certification

Job summary

CrowdStrike, Inc. is seeking a Security Engineer II to help protect customers by assessing, designing, and implementing security controls across the software supply chain.

You will focus on securing open-source footprint and upstream dependencies, perform security assessments of GitHub organizations, monitor for malicious packages, and build tooling and automations to improve operations across the code-hosting environments.

Qualifications

• Experience implementing and monitoring software security systems.
• Strong GitHub experience including repo administration and access mgmt.
• Familiarity with Bitbucket or GitLab.
• Experience with Artifactory and S3 for artifact storage.
• Experience mitigating open-source risks (SCA, licensing).
• Proficient in Python, Go, Shell, or JavaScript for automation.

Responsibilities

• Assess risk and provide security guidance on open-source usage.
• Implement and maintain GitHub guardrails and secret scanning.
• Harden open-source code usage across the enterprise.
• Investigate dependencies to mitigate supply-chain risks.
• Advocate secure coding and open-source compliance.
• Contribute to security initiatives for the code-hosting environments.

Skills

GitHub administration

GitHub Actions

Open-source security

Python

Go

Shell

JavaScript

Linux/Unix security

AI in security workflows

Tools

Artifactory

S3

Job description

CrowdStrike, Inc. is seeking a Security Engineer II to help protect customers by assessing, designing, and implementing security controls across the software supply chain.

You will focus on securing open-source footprint and upstream dependencies, perform security assessments of GitHub organizations, monitor for malicious packages, and build tooling and automations to improve operations across the code-hosting environments.