Senior DevSecOps Engineer

System One; Lafayette (LA); Hybrid; USD 120,000 - 170,000; Full time

Benefits offered by this job

Health benefits

Dental benefits

Vision benefits

401(k) plan

Life insurance

Job summary

System One is seeking a Senior DevSecOps Engineer for a hybrid, direct-hire position across Lafayette, LA; Knoxville, TN; Birmingham, AL; and Columbia, SC. You will enhance software supply chain security, governance, and artifact management within CI/CD pipelines, collaborating with security and development teams.

Requirements include 5+ years in DevSecOps or related fields, hands-on with Nexus/Sonatype, OSS policy workflows, SBOM generation, and strong AWS experience. Bachelor's degree required.

Qualifications

• 5+ years in DevSecOps, platform engineering, or software supply chain roles.
• Hands-on with Sonatype Lifecycle (IQ Server) and Nexus Repository, or similar tools like JFrog.
• Experience building automated Open Source Software evaluation policies and workflows.
• Familiarity with artifact signing technologies such as Sigstore/Cosign, GPG, or Notary.
• Experience with SLSA provenance, in toto attestations, or similar frameworks.
• Background generating SBOMs using CycloneDX, SPDX, or Syft.
• CI/CD experience, ideally with GitLab (GitHub Actions also welcome).
• Strong AWS skills across IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, and CloudWatch.
• Experience integrating security tooling directly into CI/CD pipelines.
• Solid scripting ability in Python, Bash, or Go.
• Experience maintaining enterprise open source platforms.
• Familiarity with OCI registries and package ecosystems (Maven, npm, PyPI, NuGet).
• Knowledge of NIST SSDF, Executive Order 14028, and Secure by Design principles.
• Educational Requirement: Bachelor's degree in Computer Science, Information Systems, or a related field.

Responsibilities

• Enhance artifact management, policy governance, and open source lifecycle processes using tools like Sonatype and Nexus Repository.
• Build and automate software approval workflows, quarantine/waiver processes, and repository proxy strategies across supported ecosystems.
• Drive dependency upgrades and vulnerability remediation efforts.
• Support onboarding of emerging ecosystems including AI/ML frameworks.
• Build reporting and metrics to track software supply chain health, policy compliance, and repository utilization.
• Enable CI/CD artifact signing and verification.
• Implement SLSA build provenance and attestations.
• Integrate SBOM generation into build and deployment pipelines.
• Work closely with security and development teams to improve software supply chain visibility and integrity.

Skills

DevSecOps

Platform Engineering

Cloud Security

OSS Governance

Scripting (Python/Bash/Go)

CI/CD Security

Collaboration

Education

Bachelor's degree in CS/IS or related field

Tools

Sonatype Lifecycle

Nexus Repository

JFrog

Sigstore/Cosign

GPG/Notary

SLSA/ATTESTATIONS

CycloneDX/SPDX/Syft

GitLab CI/CD

GitHub Actions

AWS (IAM, ECS/EKS, EC2, S3, Lambda)

OCI registries

Job description

Job Title: Senior DevSecOps Engineer

Locations: Lafayette, LA | Knoxville, TN | Birmingham, AL | Columbia, SC

Type: Direct Hire

Work Model: Hybrid

Hours: 40.0

Security Clearance: Not specified in the provided information or job description

Overview

Responsibilities

• Enhance artifact management, policy governance, and open source lifecycle processes using tools like Sonatype and Nexus Repository.


• Build and automate software approval workflows, quarantine/waiver processes, and repository proxy strategies across supported ecosystems.


• Drive dependency upgrades and vulnerability remediation efforts.


• Support onboarding of emerging ecosystems including AI/ML frameworks.


• Build reporting and metrics to track software supply chain health, policy compliance, and repository utilization.


• Enable CI/CD artifact signing and verification.


• Implement SLSA build provenance and attestations.


• Integrate SBOM generation into build and deployment pipelines.


• Work closely with security and development teams to improve software supply chain visibility and integrity.

Requirements

• 5+ years in DevSecOps, Platform Engineering, or Software Supply Chain Engineering.


• Hands on experience with Sonatype Lifecycle (IQ Server) and Nexus Repository, or similar tools like jFrog.


• Experience building and maintaining automated Open Source Software evaluation policies and workflows.


• Familiarity with artifact signing technologies such as Sigstore/Cosign, GPG, or Notary.


• Experience with SLSA provenance, in toto attestations, or similar frameworks.


• Background generating SBOMs using CycloneDX, SPDX, or Syft.


• CI/CD experience, ideally with GitLab (GitHub Actions also welcome).


• Strong AWS skills across IAM, ECS/EKS, EC2, S3, Lambda, Step Functions, and CloudWatch.


• Experience integrating security tooling directly into CI/CD pipelines.


• Solid scripting ability in Python, Bash, or Go.


• Experience maintaining enterprise open source platforms.


• Familiarity with OCI registries and package ecosystems (Maven, npm, PyPI, NuGet).


• Knowledge of NIST SSDF, Executive Order 14028, and Secure by Design principles.


• Educational Requirement: Bachelor's degree in Computer Science, Information Systems, or a related field.

System One, and its subsidiaries including Joulé and Mountain Ltd., are leaders in delivering outsourced services and workforce solutions across North America. We help clients get work done more efficiently and economically, without compromising quality. System One not only serves as a valued partner for our clients, but we offer eligible employees health and welfare benefits coverage options including medical, dental, vision, spending accounts, life insurance, voluntary plans, as well as participation in a 401(k) plan.

System One is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, age, national origin, disability, family care or medical leave status, genetic information, veteran status, marital status, or any other characteristic protected by applicable federal, state, or local law.